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Why  GAO  Did  This  Study 

DOD  remains  on  GAO’s  High-Risk  List 
because  of  its  long-standing  financial 
management  deficiencies.  These 
deficiencies  negatively  affect  DOD’s 
audit  readiness  and  its  ability  to  make 
sound  mission  and  operational 
decisions.  The  Army,  Navy,  and  Air 
Force  underwent  their  first  Budgetary 
Schedule  audits  for  fiscal  year  2015. 

This  report,  developed  in  connection 
with  fulfilling  GAO’s  mandate  to  audit 
the  U.S.  government’s  consolidated 
financial  statements,  examines  (1)  the 
results  of  the  audits  of  the  fiscal  year 
2015  Budgetary  Schedules  for  the 
Army,  Navy,  and  Air  Force;  (2)  the 
extent  to  which  each  military  service 
designed  a  process  to  address 
financial  management-related  audit 
findings  and  recommendations;  and 
(3)  the  extent  to  which  DOD  has 
designed  a  department-wide  process 
to  monitor  and  report  on  audit 
readiness  remediation  efforts.  GAO 
reviewed  IPA  reports  and 
documentation  from  the  military 
services  and  DOD  Comptroller  and 
interviewed  cognizant  officials. 

What  GAO  Recommends 

GAO  is  making  a  total  of  eight 
recommendations  to  the  Army,  the 
Navy,  the  Air  Force,  and  DOD  to 
improve  processes  for  tracking  and 
monitoring  financial  management- 
related  audit  findings  and 
recommendations.  The  military 
services  concurred  with  the  five 
recommendations  to  them,  while  DOD 
concurred  with  one  and  partially 
concurred  with  two  of  the 
recommendations  directed  to  it.  GAO 
continues  to  believe  that  the 
recommendations  are  valid,  as 
discussed  in  the  report. 
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What  GAO  Found 

The  Schedules  of  Budgetary  Activity  (Budgetary  Schedules)  for  the  Army,  Navy, 
and  Air  Force  for  fiscal  year  2015  reflected  current  year  budget  activity  as  an 
interim  step  toward  producing  an  auditable  Statement  of  Budgetary  Resources 
that  will  reflect  multiyear  budget  activity.  All  three  of  the  independent  public 
accountants  (IPA)  contracted  to  audit  these  fiscal  year  2015  Budgetary 
Schedules  issued  disclaimers,  meaning  that  the  IPAs  were  unable  to  express  an 
opinion  because  of  a  lack  of  sufficient  evidence  to  support  the  amounts 
presented.  The  IPAs  for  all  three  military  services  also  identified  material 
weaknesses  in  internal  control  and  collectively  issued  a  total  of  over  700  findings 
and  recommendations.  These  weaknesses  included,  among  other  things,  the 
military  services’  inability  to  reasonably  assure  that  the  Budgetary  Schedules 
reflected  all  of  the  relevant  financial  transactions  that  occurred  and  that 
documentation  was  available  to  support  such  transactions.  Army,  Navy,  and  Air 
Force  management  generally  concurred  with  these  findings  and  stated  that  they 
would  develop  and  implement  corrective  actions  to  address  the  IPAs’ 
recommendations. 

Office  of  Management  and  Budget  (OMB)  guidance  and  the  Department  of 
Defense’s  (DOD)  Financial  Improvement  and  Audit  Readiness  (FIAR)  Guidance 
include  the  following  steps  for  addressing  these  and  other  financial 
management-related  findings  and  recommendations  reported  by  external 
auditors:  (1)  identify  and  track  them,  (2)  prioritize  them,  (3)  develop  corrective 
action  plans  (CAP)  to  remediate  them,  and  (4)  monitor  the  implementation  status 
of  the  CAPs.  GAO  found  that  the  remediation  processes  designed  by  each 
military  service  had  deficiencies  in  one  or  more  of  these  areas.  For  example, 
each  military  service’s  policies  and  procedures  lacked  sufficient  controls  to 
reasonably  assure  that  they  identified  and  tracked  the  complete  universe  of  open 
findings  and  recommendations  related  to  financial  management.  Without 
identifying  and  tracking  the  complete  universe  of  unresolved  deficiencies,  the 
military  services  cannot  provide  reasonable  assurance  that  the  deficiencies  will 
be  addressed  in  a  timely  manner,  which  can  ultimately  affect  the  reliability  of 
financial  information  and  the  auditability  of  their  financial  statements. 

The  DOD  Comptroller  has  established  several  elements  of  a  department-wide 
audit  readiness  remediation  process,  but  it  does  not  have  comprehensive 
information  on  the  status  of  CAPs  throughout  the  department  needed  to  fully 
monitor  and  report  on  the  progress  being  made  to  resolve  financial 
management-related  deficiencies.  Specifically,  (1)  the  DOD  Comptroller  does  not 
obtain  complete,  detailed  information  on  all  CAPs  from  the  military  services 
related  to  the  department’s  critical  capabilities  to  be  able  to  fully  assess  progress 
and  (2)  reports  to  external  stakeholders  such  as  the  Congress  on  the  status  of 
audit  readiness  do  not  provide  comprehensive  information.  A  lack  of 
comprehensive  information  on  the  CAPs  limits  the  ability  of  DOD  and  Congress 
to  evaluate  DOD’s  progress  toward  achieving  audit  readiness,  especially  given 
the  short  amount  of  time  remaining  before  the  statutory  deadline  to  submit  to 
Congress  the  results  of  an  audit  of  the  department-wide  financial  statements  for 
fiscal  year  2018. 
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Abbreviations 

AFAA 

Air  Force  Audit  Agency 

AICPA 

American  Institute  of  Certified  Public  Accountants 

ASA 

Assistant  Secretary  of  the  Army 

ASA(FM&C) 

Assistant  Secretary  of  the  Army  (Financial  Management 
and  Comptroller) 

CAP 

corrective  action  plan 

CFO 

Chief  Financial  Officer 

DCMO 

Deputy  Chief  Management  Officer 

DFAS 

Defense  Finance  and  Accounting  Service 

DHS 

Department  of  Homeland  Security 

DOD 

Department  of  Defense 

EPR 

Evaluation,  Prioritization,  and  Remediation 

ERP 

Enterprise  Resource  Planning 

FIAR 

Financial  Improvement  and  Audit  Readiness 

IPA 

independent  public  accountant 

NDAA 

National  Defense  Authorization  Act 

OIG 

Office  of  Inspector  General 

OMB 

Office  of  Management  and  Budget 

SBR 

Statement  of  Budgetary  Resources 

SOP 

Standard  Operating  Procedure 

SSAE 

Statement  on  Standards  for  Attestation  Engagements 
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GAO 

441  G  St.  N.W. 
Washington,  DC  20548 


U.S.  GOVERNMENT  ACCOUNTABILITY  OFFICE 


February  9,  2017 


The  Honorable  Ron  Johnson 
Chairman 

The  Honorable  Claire  McCaskill 
Ranking  Member 

Committee  on  Homeland  Security  and  Governmental  Affairs 
United  States  Senate 


The  Honorable  Jason  Chaffetz 
Chairman 

The  Honorable  Elijah  E.  Cummings 
Ranking  Member 

Committee  on  Oversight  and  Government  Reform 
House  of  Representatives 


The  Department  of  Defense  (DOD)  has  been  on  GAO’s  High-Risk  List 
since  1995  because  of  long-standing  deficiencies  with  its  financial 
management  systems,  reporting  practices,  and  management  of  its 
finances.1  These  deficiencies  not  only  affect  DOD’s  ability  to  have 
auditable  financial  statements,  they  also  affect  its  ability  to  make  sound 
decisions  on  missions  and  operations.  Having  sound  financial 
management  practices  and  reliable,  useful,  and  timely  financial 
information  is  important  to  ensure  accountability  over  DOD’s  extensive 
resources  to  efficiently  and  economically  manage  the  department’s 
assets  and  budgets.  Given  the  federal  government’s  continuing  fiscal 
challenges,  reliable,  useful,  and  timely  financial  and  performance 
information  is  important  to  help  federal  managers  ensure  fiscal 
responsibility.  This  is  particularly  true  for  DOD,  whose  reported 
discretionary  spending  makes  up  half  of  the  federal  government’s  and 
whose  reported  physical  assets  represent  more  than  70  percent  of  the 
federal  government’s.2  However,  DOD  remains  one  of  the  few  entities 
that  cannot  demonstrate  its  ability  to  accurately  account  for  and  reliably 


^AO,  High-Risk  Series:  An  Update,  GAO-15-290  (Washington,  D.C.:  Feb.  11, 2015). 

2Discretionary  spending  refers  to  outlays  from  budget  authority  that  are  provided  in  and 
controlled  by  appropriation  acts,  in  contrast  to  mandatory  spending,  such  as  that  for  Social 
Security,  Medicare,  and  other  entitlement  programs,  which  is  provided  for  in  laws  other 
than  appropriation  acts. 
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report  its  spending  and  assets.  DOD’s  financial  management  problems 
remain  one  of  three  major  impediments  preventing  GAO  from  expressing 
an  opinion  on  the  consolidated  financial  statements  of  the  federal 
government. 

DOD  continues  to  work  toward  the  long-term  goals  of  improving  financial 
management  and  achieving  auditability  of  its  department-wide  financial 
statements.  In  August  2009,  the  Under  Secretary  of  Defense 
(Comptroller)/Chief  Financial  Officer  (hereinafter  referred  to  as  the  DOD 
Comptroller)  designated  the  General  Fund  Statement  of  Budgetary 
Resources  (SBR)3  as  a  major  financial  audit  priority  for  DOD.4  However, 
because  of  difficulties  encountered  in  preparing  for  an  audit  of  the  SBR, 
DOD  decided  to  limit  the  scope  of  the  initial  SBR  audits  for  all  DOD 
components.5  Specifically,  the  scope  of  initial  SBR  audits  beginning  in 
fiscal  year  2015  was  limited  to  current-year  budget  activity,  to  be  reported 
on  a  Schedule  of  Budgetary  Activity  (Budgetary  Schedule).6  This  is 
intended  to  be  an  interim  step  toward  achieving  the  audit  of  multiple-year 
budgetary  activity  required  for  an  audit  of  the  SBR;  subsequent  audits  will 
include  current-year  appropriations  as  well  as  prior-year  appropriations 
going  back  to  fiscal  year  2015. 

The  Army,  Navy,  and  Air  Force  (military  services)  asserted  audit 
readiness  for  their  Budgetary  Schedules  in  2014  and  underwent  their  first 
Budgetary  Schedule  audits  for  fiscal  year  2015.  The  DOD  Office  of 
Inspector  General  (OIG)  contracted  with  three  separate  independent 
public  accountants  (I  PA) — one  for  each  military  service — to  conduct  these 
audits.  The  IPAs  ultimately  issued  disclaimers  of  opinion  on  the  Army’s, 


3The  SBR  is  a  required  financial  statement  for  federal  government  entities,  and  is  the  only 
financial  statement  predominately  derived  from  an  entity’s  budgetary  accounts  in 
accordance  with  budgetary  accounting  rules,  which  are  incorporated  into  generally 
accepted  accounting  principles  for  federal  government  entities. 

4ln  an  August  11, 2009,  memorandum,  the  DOD  Comptroller  provided  this  designation  to 
the  SBR. 

5ln  addition  to  the  military  services,  DOD  components  include  entities  such  as  the  defense 
agencies. 

6Unlike  the  SBR,  which  reflects  multiple-year  budget  activity,  the  military  service 
Budgetary  Schedules  reflect  the  balances  and  associated  activity  related  only  to  funding 
from  fiscal  year  2015  forward.  As  a  result,  the  Budgetary  Schedules  exclude  unobligated 
and  unexpended  amounts  carried  over  from  funding  prior  to  fiscal  year  2015,  as  well  as 
information  on  the  status  and  use  of  such  funding  (e.g.,  obligations  incurred  and  outlays) 
in  fiscal  year  201 5  and  thereafter. 
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Navy’s,  and  Air  Force’s  fiscal  year  2015  Budgetary  Schedules.7  In  issuing 
a  disclaimer  of  opinion,  the  auditor  does  not  express  an  opinion  on  the 
financial  statements.  A  disclaimer  of  opinion  is  appropriate  when  the 
entity  is  unable  to  provide  sufficient  supporting  evidence  to  enable  the 
auditor  to  express  an  opinion.  In  their  reports,  the  IPAs  identified  material 
weaknesses  in  internal  control  at  all  three  military  services.8  The  IPAs  did 
not  report  any  significant  deficiencies  for  the  military  services.9 

This  audit  was  performed  in  connection  with  fulfilling  our  mandate  to  audit 
the  U.S.  government’s  consolidated  financial  statements,  which  cover  all 
accounts  and  associated  activities  of  executive  branch  agencies  such  as 
DOD,  because  of  the  significance  of  the  military  services’  audit  readiness 
activities  to  the  audit  of  the  consolidated  financial  statements  of  the  U.S. 
government.10  Our  objectives  were  to  (1)  report  the  results  of  the  audits  of 
the  fiscal  year  201 5  Budgetary  Schedules  for  the  Army,  Navy,  and  Air 
Force;  (2)  determine  the  extent  to  which  each  military  service  designed  a 
process  to  address  financial  management-related  audit  findings  and 
recommendations;  and  (3)  determine  the  extent  to  which  DOD  has 
designed  a  department-wide  process  to  monitor  and  report  on  audit 
readiness  remediation  efforts. 

To  address  our  first  objective,  we  reviewed  the  audit  work  of  the  IPAs  for 
the  military  services  by  reviewing  their  audit  reports  and  audit 


7The  Air  Force’s  IPA  issued  its  disclaimer  on  November  20,  2015;  the  Army’s  IPA  issued 
its  disclaimer  on  January  15,  2016;  and  the  Navy’s  IPA  issued  its  disclaimer  on 
February  29,  2016.  See  Department  of  Defense,  Office  of  Inspector  General,  Transmittal 
of  the  Disclaimer  of  Opinion  on  United  States  Air  Force  General  Fund  Schedule  of 
Budgetary  Activity  for  2015,  DODIG-201 6-025  (Alexandria,  VA:  Nov.  20,  2015); 

Transmittal  of  the  Disclaimer  of  Opinion  on  United  States  Army  General  Fund  Schedule  of 
Budgetary  Activity  for  FY  2015,  DODIG-201 6-039  (Alexandria,  VA:  Jan.  15,  2016);  and 
Transmittal  of  the  Disclaimer  on  the  Department  of  the  Navy  Schedule  of  Budgetary 
Activity  for  FY  2015,  DODIG-201 6-057  (Alexandria,  VA:  Feb.  29,  2016). 

8A  material  weakness  is  a  deficiency,  ora  combination  of  deficiencies,  in  internal  control 
over  financial  reporting  such  that  there  is  a  reasonable  possibility  that  a  material 
misstatement  of  the  entity’s  financial  statements  will  not  be  prevented,  or  detected  and 
corrected,  on  a  timely  basis.  A  deficiency  in  internal  control  exists  when  the  design  or 
operation  of  a  control  does  not  allow  management  or  employees,  in  the  normal  course  of 
performing  their  assigned  functions,  to  prevent,  or  detect  and  correct,  misstatements  on  a 
timely  basis. 

9A  significant  deficiency  is  a  deficiency,  or  a  combination  of  deficiencies,  in  internal  control 
that  is  less  severe  than  a  material  weakness,  yet  important  enough  to  merit  attention  by 
those  charged  with  governance. 

1031  U.S.C.  §  331(e)(2). 
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documentation  related  to  planning,  internal  control,  testing,  and  reporting 
on  the  audit.  To  address  our  second  objective,  we  reviewed  open 
financial  management  recommendations  and  the  military  services’ 
policies  and  procedures  related  to  tracking  and  addressing  findings, 
recommendations,  and  corrective  actions,  and  interviewed  Army,  Navy, 
and  Air  Force  personnel.  To  address  our  third  objective,  we  interviewed 
DOD’s  Deputy  Chief  Management  Officer  (DCMO),  the  military  services’ 
respective  DCMOs,  and  officials  within  the  Office  of  the  DOD  Comptroller 
to  determine  what  department-wide  process  has  been  designed  to 
monitor  and  report  on  the  military  services’  development  and 
implementation  of  their  corrective  action  plans  (CAP).11  We  also  gained 
an  understanding  of  the  DCMO’s  and  DOD  Comptroller’s  roles  and 
responsibilities  regarding  audit  readiness,  and  of  existing  systems  being 
used  to  help  DOD  provide  oversight  of  the  department’s  audit  readiness 
efforts.  Further  details  on  our  scope  and  methodology  are  provided  in 
appendix  I. 

We  conducted  this  performance  audit  from  March  2015  to  February  2017 
in  accordance  with  generally  accepted  government  auditing  standards. 
Those  standards  require  that  we  plan  and  perform  the  audit  to  obtain 
sufficient,  appropriate  evidence  to  provide  a  reasonable  basis  for  our 
findings  and  conclusions  based  on  our  audit  objectives.  We  believe  that 
the  evidence  obtained  provides  a  reasonable  basis  for  our  findings  and 
conclusions  based  on  our  audit  objectives. 


Background 


DOD  has  acknowledged  that  long-standing  deficiencies  in  its  internal 
controls,  business  systems,  and  processes  have  prevented  it  from  being 
able  to  demonstrate  that  its  financial  statements  are  reliable.  DOD  spends 
billions  of  dollars  annually  to  maintain  key  business  processes  and 
operations  and  to  acquire  modern  systems.  However,  progress  in  making 
system  and  process  improvements  has  been  slow  and  has  hindered 
DOD’s  ability  to  achieve  financial  audit  readiness. 

DOD  has  undertaken  several  financial  management  improvement 
initiatives  over  the  years  to  address  deficiencies  in  business  systems, 
processes,  and  controls  through  its  Financial  Improvement  and  Audit 


^According  to  the  Implementation  Guide  for  OMB  Circular  A-1 23,  CAPs  are  plans 
developed  by  management  to  present  the  procedures  that  an  agency  plans  to  follow  to 
resolve  its  deficiencies.  CAPs  should  include  measurable  indicators  of  compliance  and 
resolution  to  assess  and  validate  progress  throughout  the  resolution  cycle. 
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Readiness  (FIAR)  Plan  and  financial  management  reform  methodology 
contained  in  its  FIAR  Guidance.  DOD’s  FIAR  Guidance  provides  a 
standard,  multiphased  methodology  that  DOD  components  should  follow 
to  assess  their  financial  management  processes  and  controls  and  in 
developing  and  implementing  financial  improvement  plans.12  These  plans, 
in  turn,  are  intended  to  provide  a  framework  for  planning,  executing,  and 
tracking  essential  steps  and  related  supporting  documentation  needed  to 
achieve  auditability. 

Congress  mandated  in  the  National  Defense  Authorization  Act  (NDAA)  for 
Fiscal  Year  2010  that  DOD  develop  and  maintain  a  FIAR  Plan  that 
includes  the  specific  actions  to  be  taken  and  costs  associated  with 
(1 )  correcting  the  financial  management  deficiencies  that  impair  DOD’s 
ability  to  prepare  complete,  reliable,  and  timely  financial  management 
information  and  (2)  ensuring  that  DOD’s  financial  statements  are 
validated  as  ready  for  audit  by  September  30,  2017. 13  In  addition,  the 
2010  NDAA  required  that  DOD  provide  recurring,  semiannual  reports  to 
the  congressional  defense  committees  not  later  than  May  15  and 
November  15  on  the  status  of  the  department’s  implementation  of  the 
FIAR  Plan.14  Additionally,  the  2010  NDAA  required  the  first  semiannual 
report  to  address  DOD’s  actions  to  develop  standardized  guidance  for 
DOD  components’  financial  improvement  plans,  define  oversight  roles, 
and  assign  accountability  for  carrying  out  the  FIAR  Plan  to  appropriate 
officials  and  organizations. 

The  NDAA  for  Fiscal  Year  2013  additionally  required  that  the  FIAR  Plan 
Status  Reports  include  (1)  a  description  of  the  actions  that  each  military 
department  has  taken  to  achieve  an  auditable  SBR  for  DOD  no  later  than 
September  30,  2014,  and  (2)  a  determination  by  each  military 
department’s  Chief  Management  Officer  on  whether  the  unit  would  be 
able  to  achieve  an  auditable  SBR  no  later  than  September  30,  2014, 
without  an  unaffordable  or  unsustainable  level  of  onetime  fixes  and 
manual  work-arounds  and  without  delaying  the  auditability  of  the  financial 


12DOD’s  FIAR  Guidance  was  first  issued  in  May  2010  and  updated  in  December  2011, 
March  2013,  November  201 3,  April  2015,  and  April  2016. 

13Pub.  L.  No.  111-84,  §  1003(a),  123  Stat.  2190,  2439-40  (Oct.  28,  2009),  codified  at  10 
U.S.C.  §2222  note. 

14Pub.  L.  No.  111-84,  §  1003(b). 
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statements.15  In  the  event  that  the  Chief  Management  Officer  of  a  military 
department  determined  that  the  military  department  would  not  be  able  to 
achieve  an  auditable  SBR  by  that  date,  the  Chief  Management  Officer 
was  required  to  explain  why  the  military  department  could  not  meet  that 
date  and  provide  an  alternative  date  for  achieving  an  auditable  SBR  along 
with  a  plan  to  meet  the  alternative  date. 

In  the  November  2014  FIAR  Plan  Status  Report,  DOD  acknowledged  that 
it  did  not  meet  the  September  30,  2014,  target  date  for  achieving  audit 
readiness  of  the  SBR  (which  reflects  budgetary  activity  across  multiple 
years),  but  stated  that  the  three  military  services  asserted  audit  readiness 
of  their  Budgetary  Schedules  for  fiscal  year  2015  (which  reflect  activity  for 
1  year)  in  the  last  quarter  of  fiscal  year  2014.  The  NDAA  for  Fiscal  Year 
2014  mandated  that  the  Secretary  of  Defense  ensure  that  a  full  audit  is 
performed  on  DOD’s  fiscal  year  2018  financial  statements  and  submit  the 
results  of  that  audit  to  Congress  no  later  than  March  31,  2019. 16  Further 
detail  on  the  distinctions  between  the  SBR  and  Budgetary  Schedule  is 
provided  in  appendix  II. 


Military  Services’ 
Assertions  of  Audit 
Readiness 


The  FIAR  Guidance  was  first  issued  by  the  DOD  Comptroller  in  May  2010 
and  provides  a  standardized  methodology  for  DOD  components  to  follow 
for  achieving  financial  management  improvements  and  audit  readiness 
objectives.  However,  according  to  DOD  Comptroller  officials,  in  applying 
this  guidance  during  the  initial  years  of  discovery  and  documentation, 
they  spent  an  inordinate  amount  of  time  validating  the  military  services’ 
management  assertions,  which  delayed  an  independent  review  by  the 
DOD  OIG  or  an  IPA.  As  a  result,  DOD  Comptroller  officials  revised  their 
approach  to  leverage  independent  reviews  by  the  auditors  to  focus 
resources  and  remediation  efforts  on  most  critical  deficiencies.  To 
emphasize  the  need  for  the  military  services  to  take  ownership  of  their 
own  audit  readiness  assertions  for  their  Budgetary  Schedules,  this 
approach  was  applied  to  the  decision  to  proceed  with  the  audits  of  the 
fiscal  year  2015  Budgetary  Schedules.  According  to  DOD  Comptroller 
officials,  they  participated  in  ongoing  dialogue  with  the  military  services  at 
audit  readiness  oversight  meetings  and  reviewed  their  progress  in  key 


15Pub.  L.  No.  112-239,  §  1005(b),  126  Stat.  1632,  1904  (Jan.  2,  2013),  codified  at  10 
U.S.C.  §2222  note. 

16Pub.  L.  No.  113-66,  §  1003,  127  Stat.  671,  842  (Dec.  26,  2013),  codified  at  10  U.S.C.  § 
2222  note. 
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areas,  but  the  military  services  did  not  have  to  provide  detailed 
documentation  to  the  DOD  Comptroller’s  office  in  support  of  their 
assertions  of  audit  readiness  for  their  Budgetary  Schedules.  Instead, 
each  military  service  submitted  a  memo  to  the  DOD  OIG  prior  to 
September  30,  2014,  asserting  that  its  Budgetary  Schedule  was  either 
ready  or  would  be  ready  for  audit  beginning  with  fiscal  year  201 5. 

In  their  assertion  memos,  the  Army  stated  that  its  Budgetary  Schedule 
was  ready  for  audit  and  the  Air  Force  stated  that  its  schedule  would  be 
ready.  The  Army  and  Air  Force  assertion  memos  stated  that  the 
assertions  depended  on  planned  corrective  actions  (e.g.,  producing  a 
complete  population  of  transactions  and  implementing  service  provider 
integration).17  The  Navy’s  assertion  memo  stated  that  its  Budgetary 
Schedule  was  ready  for  audit  based  on  the  results  of  the  multiyear  effort 
to  document,  test,  and  remediate  known  control  deficiencies  related  to  its 
procedures,  processes,  controls,  and  financial  systems. 


Military  Services’  Funds  Each  military  service  is  organized  into  two  reporting  entities:  a  general 

fund  and  a  working  capital  fund.18  A  military  service’s  general  fund 
account  structure  includes  five  major  groups:  (1)  military  personnel; 

(2)  operations,  readiness  and  support;  (3)  procurement;  (4)  research, 
development,  test  and  evaluation;  and  (5)  family  housing/military 
construction.  Each  military  service’s  programs  are  authorized  by 
Congress  in  annual  NDAAs,  and  each  military  service  receives 
appropriations  from  Congress  through  annual  appropriations  acts.  Table 
1  presents  information  on  each  military  service’s  fiscal  year  2015  general 
fund  appropriations,  personnel,  and  locations. 


17A  population  represents  the  items  constituting  the  account  balance  or  class  of 
transactions  of  interest. 

1 8 

Each  military  service’s  appropriations  and  other  funds  are  classified  as  general,  working 
capital  (revolving),  trust,  special,  and  deposit  funds.  The  military  services  use  these  funds 
(excluding  deposit  funds)  to  execute  their  missions.  Deposit  funds  are  used  to  record 
amounts  held  temporarily  until  paid  to  the  appropriate  government  or  public  entity.  They 
are  not  funds  belonging  to  the  federal  government  and,  as  such,  are  not  available  for 
general  fund  operations.  See  Treasury  Financial  Manual,  vol.  1,  pt.  2,  sec.  1535.  The 
working  capital  fund  operates  as  a  self-sustaining  entity,  financing  inventories  of  common 
supplies  and  providing  working  capital  for  industrial  and  commercial  activities  that  provide 
common  services  within  or  among  DOD  entities.  See  10  U.S.C.  §  2208.  The  working 
capital  fund  is  intended  to  (1 )  generate  sufficient  resources  to  cover  the  full  costs  of  its 
operations  and  (2)  operate  on  a  break-even  basis  over  time.  The  financial  activity  reported 
through  the  working  capital  fund  was  not  within  the  scope  of  the  fiscal  year  2015 
Budgetary  Schedule  audits. 
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Table  1:  Fiscal  Year  2015  General  Fund  Appropriations,  Personnel,  and  Locations 


Army 

Navy* * 3 4 

Air  Force 

Fiscal  year  2015  general  fund 
appropriations13 

$148  billion 

$159  billion" 

$153  billion 

Personnel: 

Active  duty 

491,000 

328,000 

308,000 

Reserve 

199,000 

57,000 

67,100 

National  Guard 

350,000 

N/Ad 

105,000 

Civilian 

215,000 

175,000 

179,900 

Locations 

154  permanent 
installations  worldwide 

70  shore  bases  located 
in  11  regions  worldwide 

79  major  bases  and 
77  minor  bases  worldwide 

Sources:  Army,  Navy,  and  Air  Force  agency  financial  reports  and  the  Department  of  Defense’s  budget  request  for  fiscal  year  201 5.  |  GAO-1 7-85 

aThe  Department  of  the  Navy  consists  of  two  uniformed  services:  the  United  States  Navy  and  the 
United  States  Marine  Corps. 

bConsolidated  and  Further  Continuing  Appropriations  Act,  2015,  Pub.  L.  No.  113-235,  128  Stat.  2130, 
2234  (Dec.  16,  2014). 

cThe  Navy  received  $159  billion  in  general  fund  appropriations  of  which  $1.5  billion  is  designated  for 
the  Marine  Corps. 

dThe  Navy  does  not  have  a  National  Guard  component. 


Audits  of  the  Army’s, 
Navy’s,  and  Air 
Force’s  Fiscal  Year 
2015  Budgetary 
Schedules  Resulted 
in  Disclaimers  of 
Opinion 


The  Army,  Navy,  and  Air  Force  asserted  audit  readiness  for  their 
Budgetary  Schedules  in  2014  and  underwent  their  first  Budgetary 
Schedule  audits  for  fiscal  year  2015.  The  IPAs  for  all  three  military 
services  issued  disclaimers  of  opinion  on  the  respective  services’  fiscal 
year  2015  Budgetary  Schedules  and  identified  material  weaknesses  in 

internal  control.  For  example,  all  three  IPAs  reported  findings  related  to 
the  military  services’  inability  to  (1)  provide  complete  populations  of 
transactions,  (2)  provide  documentation  to  support  transactions, 

(3)  effectively  implement  information  system  controls  to  protect  their 
financial  data  in  both  general  ledgers  and  related  feeder  systems,  and 

(4)  exercise  sufficient  oversight  of  their  service  providers.19  The  IPAs  for 
all  three  military  services  reported  each  of  these  reportable  findings  as  a 
stand-alone  material  weakness  or  as  part  of  a  larger,  combined  material 


19As  defined  in  generally  accepted  government  auditing  standards,  information  technology 
controls  consist  of  those  internal  controls  that  depend  on  information  systems  processing 
and  include  general  controls  and  application  controls. 
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weakness.20  Army,  Navy,  and  Air  Force  management  generally  concurred 
with  the  findings  in  the  respective  I  PA  reports  and  stated  that  they  will 
develop  and  execute  corrective  actions  to  address  the  IPAs’  related 
findings. 


Army,  Navy,  and  Air  Force 
Were  Unable  to  Provide 
Complete  Populations  of 
Transactions 


The  IPAs  for  all  three  military  services  reported  that  they  were  unable  to 
identify  complete  populations  of  transactions  for  the  respective  services’ 
fiscal  year  2015  Budgetary  Schedules.  This  reportable  finding  contributed 
to  each  IPA’s  disclaimer  of  opinion.  For  financial  statements  to  be 
considered  reliable,  they  must  reflect  the  results  of  all  significant  financial 
activity  (transactions)  during  the  reporting  period  (e.g.,  1  fiscal  year  for  the 
Budgetary  Schedules).  When  performing  a  financial  statement  audit,  one 
of  the  assertions  that  the  auditor  evaluates  is  completeness,21  which 
pertains  to  whether  all  transactions  and  events  that  should  have  been 
recorded  in  the  financial  statements  were  recorded. 


Most  military  service  transactions  are  initially  processed  and  recorded  in 
information  technology  systems  called  feeder  systems.  For  example, 
payroll  transactions  are  processed  in  a  military  service’s  payroll  system. 
Transactions  processed  in  feeder  systems  should  eventually  be 
transferred  to  the  military  service’s  general  ledger  where  all  transactions 
are  accumulated.22  At  the  end  of  a  reporting  period,  each  military 
service’s  general  ledger  data  are  transferred  to  DOD’s  financial  reporting 
system,  which  summarizes  the  financial  data  according  to  the  line  items 
that  are  ultimately  reported  in  the  financial  statements. 


20For  purposes  of  this  report,  a  reportable  finding  includes  both  stand-alone  material 
weaknesses  and  deficiencies  that  the  IPA  reported  as  part  of  a  combined  material 
weakness.  For  example,  the  Navy’s  IPA  reported  three  of  these  deficiencies  (complete 
populations  of  transactions,  documentation  to  support  transactions,  and  service  provider 
oversight)  as  part  of  an  overall  material  weakness  over  financial  reporting. 

21  Financial  statement  assertions  are  management  representations  such  as  completeness 
and  existence  that  are  embodied  in  financial  statement  components  (i.e.,  assets,  liabilities, 
equity,  revenue,  and  expenses).  Most  of  the  auditor’s  work  in  forming  an  opinion  on 
financial  statements  consists  of  obtaining  and  evaluating  sufficient  appropriate  evidence 
concerning  the  assertions  in  the  financial  statements. 

22 A  general  ledger  is  the  master  set  of  accounts  that  summarize  all  transactions  occurring 
within  an  entity.  The  general  ledger  accounting  system  works  as  a  central  repository  for 
accounting  data  transferred  from  all  subsidiary  ledgers  (i.e.,  feeder  systems).  The  Army 
and  Navy  each  have  more  than  one  general  ledger.  In  recent  years,  the  military  services 
have  been  transitioning  from  their  inefficient  legacy  general  ledgers  to  more  modern 
systems. 
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Figure  1  illustrates  how  financial  data  for  the  military  services  are  initially 
processed,  then  combined  with  other  data  as  they  are  transferred  from 
one  automated  system  to  another,  and  ultimately  result  in  the  Budgetary 
Schedule. 


Figure  1 :  Flow  of  Financial  Transaction  Data  for  Military  Services 


Feeder 

systems 


General  ledger(s)/  Budgetary 

legacy  systems  reporting  system 


Financial  statement  Schedule  of 

reporting  system  Budgetary  Activity 


Initiate  transaction 
level  data  and 
distribute  data  to 
general  ledger(s) 


Maintain 

data  and  distribute  to 
budgetary  reporting  system 


Compiles  and 
analyzes  data  and 
records  adjustments 
to  data 


Receives  edit-checked 
data  from  budgetary 
reporting  system  and 
creates  Schedule 
of  Budgetary  Activity 


Source:  GAO  analysis  of  transaction  data  flow.  |  GAO-17-85 


When  data  are  transferred  from  one  system  to  another,  interface  controls 
should  be  in  place  to  reasonably  assure  that  the  data  are  transferred 
accurately,  timely,  and  completely.  The  objectives  of  interface  controls 
are  to  implement  effective  (1)  interface  strategy  and  design  and 
(2)  interface  processing  procedures.23  Effective  interface  procedures 
reasonably  assure  that  interfaces  are  processed  completely,  accurately, 
and  only  once  in  the  proper  period;  interface  errors  are  rejected,  isolated, 
and  corrected  in  a  timely  manner;  and  access  to  interface  data  and 
processes  is  properly  restricted.  The  systems  should  be  designed  with 
balancing  controls,  such  as  control  totals  and  record  counts,  to 
reasonably  assure  that  data  are  controlled.  Also,  the  entity  should  have 
effective  procedures  to  reconcile  control  information  between  the  two 
systems.  If  the  reconciliation  identifies  differences,  these  differences 
should  be  researched  to  determine  their  causes  and  any  errors  corrected. 
This  reconciliation  process  helps  ensure  that  the  results  of  all  transactions 
occurring  during  the  reporting  period  are  accurately  reported  in  the 
financial  statements. 


In  conducting  the  audits  of  the  military  services’  Budgetary  Schedules,  the 
IPAs  reviewed  the  military  services’  reconciliation  processes  to  determine 


no 

An  interface  strategy  describes  at  a  high  level  how  interfaces  are  implemented  between 
two  applications  and  is  the  basis  for  interface  design  and  scope. 
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whether  all  transactions  were  completely  transferred  from  military 
services’  feeder  systems  to  the  general  ledgers  and,  ultimately,  to  the 
DOD-wide  financial  reporting  system.  The  IPAs  reported  that  the  military 
services  did  not  have  sufficient  reconciliation  processes  in  place  to 
reasonably  assure  that  the  general  ledgers  included  all  of  the  transactions 
that  should  be  included  in  the  Budgetary  Schedules,  increasing  the  risk 
that  the  Budgetary  Schedules  did  not  reflect  the  results  of  all  budgetary 
transactions  that  occurred. 

The  following  are  examples  of  completeness  issues  reported  by  the  IPAs. 

•  The  Army  was  unable  to  reconcile  the  first  quarter  fiscal  year  201 5 
population  of  civilian  payroll  transactions  from  a  civilian  pay  feeder 
system  to  one  of  its  four  general  ledger  systems. 

•  The  Navy  had  no  assurance  that  transactions  were  completely  and 
accurately  recorded  in  its  four  general  ledger  systems  because  it  has 
not  designed  and  implemented  sustainable  and  recurring  manual  and 
automated  reconciliations  with  its  more  than  100  feeder  systems. 

•  The  Air  Force’s  nonintegrated  information  technology  system 
environment  requires  both  manual  reentry  of  data  into  multiple 
systems  and  complex  system  interfaces.  The  auditors  found  that  the 
Air  Force  did  not  always  reconcile  the  data  after  entering  the  data 
manually  or  transferring  the  data  from  interfacing  systems.  The 
auditors  reported  that  many  of  the  reconciliations  were  newly 
implemented  and  not  in  place  during  the  entire  fiscal  year  or  were  not 
performed  through  the  end  of  the  fiscal  year. 


Army,  Navy,  and  Air  Force 
Were  Unable  to  Provide 
Documentation  to  Support 
Transactions 


The  IPAs  for  all  three  military  services  noted  the  lack  of  adequate 
supporting  documentation  as  a  reportable  finding  on  their  Budgetary 
Schedule  audits,  which  also  contributed  to  each  IPA’s  disclaimer  of 
opinion.  Appropriate  documentation  for  financial  transactions  allows  the 
military  services  to  support  financial  statement  line  items  and  allows 
auditors  to  test  line  items.  For  all  three  military  services,  auditors  found 
that  adequate  documentation  to  support  disbursements  and  obligations 
was  not  always  available.  The  lack  of  adequate  documentation  increased 
the  risk  of  a  misstatement  on  the  Budgetary  Schedules. 
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According  to  Standards  for  Internal  Control  in  the  Federal  Government,24 
developing  and  maintaining  thorough  and  accurate  documentation  to 
support  financial  transactions  is  essential  to  management’s  ability  to 
effectively  monitor  financial  transactions  and  provide  reasonable 
assurance  that  internal  controls  are  in  place  and  operating  as  intended. 
Accurate  documentation  also  allows  management  to  correct  errors  timely 
and  safeguard  assets.  Additionally,  appropriate  documentation  of 
financial  transactions  allows  support  to  be  readily  available  for 
examination  by  an  auditor. 

The  following  are  examples  of  supporting  documentation  issues  reported 
by  the  IPAs: 

•  The  Army  did  not  have  documentation  readily  available  to 
demonstrate  that  specific  transactions  were  properly  reported  in  the 
Budgetary  Schedule.  Specifically,  the  auditors  reported  that 
documentation  supporting  contractual  services,  military  payroll, 
civilian  payroll,  reimbursable  authority,  disbursement,  and  collection 
transactions  was  either  not  available,  was  insufficient,  or  did  not  agree 
to  the  general  ledger  detail. 

•  The  Navy  did  not  always  have  the  underlying  detail  for  journal 
vouchers  or  sometimes  lacked  complete  explanations  for  the  purpose 
of  journal  vouchers.25  The  auditors  reported  that  in  some  cases, 
journal  vouchers  were  used  to  adjust  amounts  to  agree  with 
Department  of  the  T reasury  (T reasury)  or  trading  partner  balances, 
without  underlying  support  for  the  adjustment  amounts. 

•  The  Air  Force  did  not  always  maintain  adequate  documentation  to 
support  disbursements  and  obligations.26  The  auditors  reported  a  lack 


24GAO,  Standards  for  Internal  Control  in  the  Federal  Government,  GAO/AIM D-00-21 .3. 1 
(Washington,  D.C.:  November  1999),  contains  the  internal  control  standards  to  be 
followed  by  executive  agencies  in  establishing  and  maintaining  systems  of  internal  control 
as  required  by  31  U.S.C.  §  3512  (c),  (d)  (commonly  referred  to  as  the  Federal  Managers’ 
Financial  Integrity  Act).  Standards  for  Internal  Control  in  the  Federal  Government  was 
revised  in  September  2014,  and  the  new  standards  are  effective  beginning  with  fiscal  year 
2016.  This  section  of  the  report  addresses  internal  control  deficiencies  from  the  fiscal  year 
2015  Schedule  of  Budgetary  Activity  audit;  therefore,  the  November  1999  version  of 
Standards  for  Internal  Control  in  the  Federal  Government  was  referenced  here. 

25Journal  vouchers  are  used  to  process  monthly,  quarterly,  and  annual  adjustments  to 
account  balances  in  accounting  and  reporting  systems. 

26An  obligation  is  a  definite  commitment  that  creates  a  legal  liability  of  the  government  for 
the  payment  of  goods  and  services  ordered  or  received.  Payment  may  be  made 
immediately  or  in  the  future. 
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of  adequate  supporting  documentation  for  transactions  related  to 
travel  expenses  and  payments  made  to  vendors  and  contractors  for 
purchases  of  goods  and  services. 


Army,  Navy,  and  Air  Force 
Did  Not  Have  Adequate 
Information  System 
Controls 


The  IPAs  for  all  three  military  services  identified  a  lack  of  adequate 
information  systems  general  controls  as  another  reportable  finding,  which 
precluded  the  IPAs’  ability  to  rely  on  the  services’  financial  data  and  thus 
contributed  to  their  disclaimers  of  opinion.27  The  military  services’  ability 
to  efficiently  and  effectively  manage  and  oversee  their  day-to-day 
operations  and  programs  relies  heavily  on  the  capacity  of  their  financial 
management  information  systems  to  produce  complete,  reliable,  timely, 
and  consistent  financial  information.  The  IPAs  for  all  three  military 
services  identified  information  systems  general  control  deficiencies 
related  to  access  controls,  segregation  of  duties,  and  configuration 
management.  In  addition,  the  I  PA  for  the  Army  identified  information 
systems  general  control  deficiencies  in  security  management  and 
contingency  planning;  the  IPA  for  the  Navy  reported  information  system 
general  control  deficiencies  in  security  management  and  information 
system  control  deficiencies  related  to  interface  controls;  and  the  IPA  for 
the  Air  Force  reported  information  system  control  deficiencies  related  to 
interface  controls. 


The  following  are  examples  of  information  system  control  deficiencies 
reported  by  the  IPAs. 

•  The  Army  did  not  consistently  perform  effective  daily  operating  system 
backup  procedures  or  maintain  evidence  of  operating  system  and 
database  backups  when  performed  for  certain  financial  systems.  As  a 
result,  the  IPA  concluded  that  this  condition  could  affect  the  Army’s 
ability  to  provide  financial  data  that  are  complete,  valid,  and  accurate. 
Further,  the  IPA  found  that  the  Army  and  its  service  providers  had  not 
implemented  sufficient,  effective  information  system  general  controls 
to  protect  the  Army’s  general  ledgers  and  related  feeder  systems’ 
financial  data. 


27General  controls  are  the  structure,  policies,  and  procedures  that  apply  to  an  entity’s 
overall  computer  operations.  Examples  of  the  primary  objectives  for  general  controls  are 
to  safeguard  data,  protect  business  process  application  programs,  and  ensure  continued 
computer  operations  in  case  of  unexpected  interruptions.  Without  effective  general 
controls,  business  process  application  controls  can  generally  be  rendered  ineffective  by 
circumvention  or  modification. 
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•  The  Navy  did  not  consistently  implement  effective  interface  controls 
between  its  systems  and  its  service  providers.  As  a  result,  the  I  PA 
found  that  the  Navy  was  unable  to  reasonably  assure  the 
completeness  and  accuracy  of  financial  data  flowing  between  its 
systems  and  the  service  providers.  The  I  PA  found  that  the  Navy  also 
lacked  effective  information  system  controls  over  its  general  ledger 
systems  and  financial  feeder  systems  and  had  pervasive  control 
deficiencies  in  its  decentralized  information  system  environment. 

•  The  Air  Force  did  not  have  controls  in  place  to  prevent  certain 
individuals  from  controlling  key  aspects  of  computer-related 
operations;  as  a  result,  the  I  PA  found  that  unauthorized  access  to 
systems  and  system  information  and  unauthorized  actions  had 
occurred.  Multiple  systems  allowed  a  significant  number  of 
administrator  users  the  authority  to  complete  an  entire  functional 
process  by  inputting,  processing,  and  approving  transactions. 
Additionally,  the  IPA  reported  that  developers  were  granted 
inappropriate  access  to  make  modifications  directly  to  the  production 
environment  and  delete  system  files. 


Army,  Navy,  and  Air  Force 
Did  Not  Exercise  Sufficient 
Oversight  of  Their  DOD 
Service  Providers 


The  IPAs  identified  insufficient  oversight  by  the  Army,  Navy,  and  Air 
Force  of  DOD  service  organizations,  also  referred  to  as  service  providers, 
as  a  reportable  finding  that  also  contributed  to  each  IPA’s  disclaimer  of 
opinion.28  Specifically,  the  IPAs  for  all  three  military  services  found  that 
the  services  did  not 


•  exercise  sufficient  oversight  of  their  service  providers  responsible  for 
performing  financial  reporting  activities  to  ensure  completeness, 
accuracy,  and  validity  of  the  financial  data  reported  and 


oo 

The  American  Institute  of  Certified  Public  Accountants  (AICPA)  defines  a  service 
organization  as  “an  organization  or  segment  of  an  organization  that  provides  services  to 
user  entities,  which  are  likely  to  be  relevant  to  those  user  entities'  internal  control  over 
financial  reporting.”  The  AICPA  issued  the  Statement  on  Standards  for  Attestation 
Engagements  (SSAE)  No.  16,  Reporting  on  Controls  at  a  Service  Organization,  to 
address  examination  engagements  undertaken  by  service  organizations.  In  April  2016,  the 
AICPA  issued  SSAE  No.  18,  Attestation  Standards:  Clarification  and  Recodification,  which 
supersedes  SSAE  No.  1 6  and  is  effective  for  service  organization  reports  dated  on  or  after 
May  1,2017. 
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•  evaluate  the  complementary  user  entity  controls29  included  in  the 
Statement  on  Standards  for  Attestation  Engagements  (SSAE)  No.  16 
reports  to  determine  design  and  operating  effectiveness.30 

The  Army,  Navy,  and  Air  Force  utilize  many  service  providers  to  improve 
efficiency  and  standardize  business  operations.  Among  the  many  service 
providers  within  DOD  are  the  Defense  Finance  and  Accounting  Service 
(DFAS),  Defense  Information  Systems  Agency,  Defense  Logistics 
Agency,  and  Defense  Contract  Management  Agency.  According  to  the 
FIAR  Guidance,  the  Army,  Navy,  and  Air  Force  rely  on  these  DOD 
service  organizations  to  provide  a  variety  of  accounting,  personnel, 
logistics,  and  system  operations  services.31 

Each  of  the  reporting  entities — the  Army,  Navy,  and  Air  Force — is 
ultimately  responsible  for  ensuring  that  all  key  processes,  systems, 
internal  controls  (including  those  performed  by  service  organizations), 
and  supporting  documentation  affecting  its  financial  reporting  objectives 
are  audit  ready.  However,  service  providers  working  with  reporting 
entities  are  also  responsible  for  executing  audit  readiness  activities 
surrounding  service  provider  systems  and  data,  processes  and  internal 
controls,  and  supporting  documentation  that  have  a  direct  effect  on  the 
reporting  entities’  audit  readiness. 

Therefore,  to  ensure  successful  completion  of  audit  readiness  tasks,  the 
reporting  entity  and  service  provider  must  agree  on  the  roles  and 
responsibilities  for  the  authorization,  initiation,  processing,  recording,  and 
reporting  of  transactions;  the  information  technology  controls  affected  by 
the  service  provider;  or  both.  The  FIAR  Guidance  states  that  a  shared 


OQ 

Complementary  user  entity  controls  are  those  controls  that  management  of  the  service 
provider,  in  designing  the  service(s)  provided,  assumes  are  implemented  by  the 
user/reporting  entity.  According  to  the  FIAR  Guidance,  the  reporting  entity  must  coordinate 
with  the  service  provider  to  understand  the  service  provider’s  user  entity  control 
assumptions  and  test  those  user  entity  controls  to  determine  whether  they  are  operating 
effectively.  Complementary  user  entity  control  considerations  relate  to  the  control 
objectives  specified  in  the  service  organization  management’s  description  of  the  service 
provider  system. 

30These  reports  are  designed  to  provide  information  on  the  effectiveness  of  controls  at  the 
service  organization  (an  organization  that  operates  information  systems  and  provides 
information  system  services  to  other  entities)  for  user  entities  to  use  in  assessing  the 
effectiveness  of  internal  controls  over  their  financial  reporting.  These  reports,  prepared  by 
IPAs,  are  based  on  examinations  performed  under  the  AlCPA’s  SSAE  No.  16  and  are 
commonly  referred  to  as  SSAE  No.  16  reports. 

31FIAR  Guidance,  §2.G.6  (April  2016). 
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understanding  and  agreement  between  the  service  provider  and  reporting 
entity  on  these  roles  and  responsibilities  must  be  documented  in  a 
service-level  agreement  or  memorandum  of  understanding.  According  to 
the  FIAR  Guidance,  these  mutual  responsibilities  include 

•  maintaining  open  communications  and  coordinating  with  one  another; 

•  establishing  common  expectations  in  writing; 

•  providing  additional  system  and  financial  information  within  agreed- 
upon  time  frames; 

•  providing  access  to  subject  matter  experts  or  contractors  supporting 
those  organizations  within  agreed-upon  time  frames; 

•  working  together  to  discover  and  correct  audit  impediments;  and 

•  establishing  a  common,  detailed  understanding  of  the  method  for 
obtaining  assurance. 

According  to  the  FIAR  Guidance,  reporting  entity  management  is 
responsible  for  the  internal  control  over  their  financial  information  and 
therefore  must  ensure  that  it  understands  what  financially  significant 
activities  are  outsourced  to  service  providers  and  the  effectiveness  of  the 
service  providers’  related  internal  controls.  In  turn,  each  service  provider 
is  responsible  for  providing  a  description  of  its  controls  that  may  affect  its 
customer  reporting  entities’  control  environments,  risk  assessment, 
control  activities,  and  information  and  communication  systems.  Appendix 
D  to  Office  of  Management  and  Budget  (OMB)  Circular  A-1 23, 
“Compliance  with  the  Federal  Financial  Management  Improvement  Act  of 
1996,”  requires  each  service  provider  to  provide  a  Report  on  Controls  at  a 
Service  Organization  Relevant  to  User  Entities’  Internal  Control  over 
Financial  Reporting  to  its  customers  or  allow  customer  auditors  to  perform 
appropriate  tests  of  internal  controls  at  its  organizations.32  These  reports 
are  an  important  tool  for  agency  management  and  auditors  to  use  in 
evaluating  the  effect  of  the  controls  at  the  service  organization  on  the 
user  entities’  controls  for  financial  reporting. 

The  following  are  IPA-identified  examples  of  insufficient  oversight  by  the 
Army,  Navy,  and  Air  Force  of  their  service  providers. 


oo 

Office  of  Management  and  Budget,  “Compliance  with  the  Federal  Financial 
Management  Improvement  Act  of  1996,”  app.  D  of  Management’s  Responsibility  for 
Internal  Control,  OMB  Circular  A-123  (Washington,  D.C.:  Sept.  20,  2013),  provides 
guidance  for  determining  compliance  with  the  Federal  Financial  Management 
Improvement  Act  of  1 996  for  agencies  subject  to  the  Chief  Financial  Officers  Act  of  1 990. 
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•  The  Army  did  not  have  policies  and  procedures  to  assess  service 
providers  that  host  or  manage  financial  systems  that  support  accounts 
reported  on  the  Army's  Budgetary  Schedule.  Specifically,  the  I  PA 
found  that  the  Army  did  not  document  its  understanding  of  the 
services  provided  or  the  related  SSAE  No.  16  reports  so  that  it  could 
determine  whether  the  scope  of  these  reports  met  the  Army’s  needs 
for  obtaining  assurance  regarding  service  provider  controls. 

•  The  Navy  did  not  implement  effective  controls  over  its  service  provider 
systems.  As  a  result,  the  IPA  (1)  encountered  difficulties  in  identifying 
key  points  of  contact  within  the  Navy,  (2)  reported  that  appropriate 
service-level  agreements  with  the  Navy’s  service  providers  were  not 
fully  developed,  and  (3)  noted  that  Navy  personnel  did  not  periodically 
review  available  SSAE  No.  16  reports. 

•  The  Air  Force  compiled  a  list  of  complementary  user  entity  controls; 
however,  the  IPA  found  that  it  did  not  validate  the  operating 
effectiveness  of  the  controls  or  verify  the  accuracy  and  completeness 
of  the  complementary  user  entity  controls  list. 


The  Military  Services 
Did  Not  Sufficiently 
Design  Their 
Processes  to  Address 
Financial 
Management 
Deficiencies 


The  IPAs  for  the  Army,  Navy,  and  Air  Force  collectively  issued  over  700 
notices  of  findings  and  recommendations  to  the  respective  military 
services  during  the  course  of  the  fiscal  year  2015  Budgetary  Schedule 
audits.  Each  notice  had  one  or  more  findings  and  discussed  deficiencies 
that  the  IPA  identified  during  the  audit  along  with  a  corresponding 
recommendation(s)  for  addressing  the  deficiencies.  These  deficiencies 
pertained  primarily  to  internal  control  deficiencies,  with  almost  75  percent 
of  these  related  to  information  systems.  In  addition,  the  military  services 
received  findings  and  recommendations  related  to  financial  management 
deficiencies  identified  during  audits  performed  by  other  audit 
organizations,  including  the  DOD  OIG  and  GAO,  which  also  must  be 
remediated.  Also,  management  may  have  identified  financial 
management  deficiencies,  for  example,  through  OMB  Circular  A-1 23 
reviews  or  management  studies. 


Each  military  service  is  responsible  for  establishing  its  own  processes  for 
addressing  these  findings  and  recommendations  by  (1)  identifying  and 
tracking  them,  (2)  prioritizing  them,  (3)  developing  corrective  action  plans 
(CAP)  to  address  them,  and  (4)  monitoring  the  status  of  CAP 
implementation.  However,  we  found  to  varying  degrees  that  each  service 
did  not  have  sufficient  processes  for  doing  so.  While  the  military  services 
should  have  already  had  such  processes  in  place  to  manage  findings  and 
recommendations  resulting  from  any  audit,  the  need  to  effectively 
implement  these  processes  has  become  more  important  in  light  of  (1)  the 


Page  17 


GAO-17-85  DOD  Audit  Readiness 


many  findings  and  recommendations  that  resulted  from  the  Budgetary 
Schedule  audits,  (2)  future  audits  that  will  have  a  broader  scope  of  work 
and  may  therefore  identify  additional  findings,  and  (3)  the  short  period 
remaining  before  the  fiscal  year  2018  audits  must  occur.  For  example, 
with  the  large  number  of  findings  resulting  from  the  Budgetary  Schedule 
audits  and  the  effort  it  will  take  to  address  them  all,  prioritization  of 
deficiencies  that  preclude  the  ability  to  audit  the  financial  statements  is 
crucial  for  the  military  services  to  achieve  audit  readiness. 

We  compared  the  military  services’  existing  processes  to  the  guidance 
and  standards  defined  in  the  Implementation  Guide  for  OMB  Circular  A- 
123,  Management’s  Responsibility  for  Internal  Control,  Appendix  A, 
Internal  Control  over  Financial  Reporting  (Implementation  Guide  for  OMB 
Circular  A-123);  the  FIAR  Guidance;  and  Standards  for  Internal  Control  in 
the  Federal  Government.33  According  to  these  sources,  which  we  used  as 
criteria  in  evaluating  the  design  of  the  services’  existing  processes,  a 
sound  approach  to  addressing  financial  management  deficiencies  would 
include  the  following  four  elements. 

1 .  Identifying  and  tracking  audit  findings  and  recommendations. 

Federal  internal  control  standards  require  that  managers  (1)  promptly 
evaluate  findings  from  audits  and  other  reviews,  including  those 
showing  deficiencies  and  recommendations  reported  by  auditors  and 
others  who  evaluate  agencies’  operations;  (2)  determine  proper 
actions  in  response  to  findings  and  recommendations  from  audits  and 
reviews;  and  (3)  complete,  within  established  time  frames,  all  actions 
that  are  needed  to  correct  or  otherwise  resolve  the  matters  brought  to 
management’s  attention.  To  ensure  that  these  actions  are  taken, 
management  needs  a  means — that  is,  accurate  and  adequate 
documentation — to  keep  track  of  the  findings  and  recommendations. 

2.  Prioritizing  findings  and  recommendations.  The  Implementation 
Guide  for  OMB  Circular  A-123  and  the  April  2016  FIAR  Guidance 
state  that  the  extent  to  which  corrective  actions  are  tracked  should  be 
commensurate  with  the  severity  of  the  deficiency.  The  Implementation 
Guide  for  OMB  Circular  A-123  also  states  that  an  agency’s  senior 
assessment  team  will  work  with  the  responsible  officials  and 
personnel  to  determine  which  deficiencies  are  cost  beneficial  to 
correct. 


33GAO,  Standards  for  Internal  Control  in  the  Federal  Government ,  GAO-14-704G 
(Washington,  D.C.:  September  2014).  We  used  guidance  in  effect  for  fiscal  year  2016 
because  we  reviewed  audit  follow-up  procedures  that  took  place  during  fiscal  year  2016. 
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3.  Developing  CAPs.  The  Implementation  Guide  for  OMB  Circular  A- 

123  states  that  a  CAP,  including  targeted  milestones  and  completion 

dates,  will  be  drafted  and  progress  will  be  monitored.  The  elements  of 

a  CAP  include 

•  a  summary  description  of  the  deficiency; 

•  the  year  the  deficiency  was  first  identified; 

•  the  target  corrective  action  date  (the  date  of  management  follow¬ 

up); 

•  the  agency  official  responsible  for  monitoring  progress; 

•  the  indicators,  statistics,  or  metrics  used  to  gauge  resolution 
progress  (in  advance  of  audit  follow-up)  in  order  to  validate  the 
resolution  of  the  deficiency  (referred  to  as  outcome  measures  for 
assessing  the  effectiveness  of  the  corrective  actions  for  purposes 
of  this  report);  and 

•  the  quantifiable  target  or  otherwise  qualitative  characteristic  that 
reports  how  resolution  activities  are  progressing  (referred  to  as 
interim  milestones  for  monitoring  progress  on  interim  actions  for 
purposes  of  this  report). 


DOD’s  FIAR  Guidance  states  that  CAPs  should  be  developed  for  all 
material  weaknesses  and  that  progress  in  implementing  these  plans 
should  be  periodically  assessed  and  reported  to  management,  which 
should  track  progress  to  ensure  timely  and  effective  results.  For 
significant  deficiencies,  as  well  as  nonsignificant  deficiencies  that 
were  not  externally  reported,  CAPs  should  be  developed  and  tracked 
internally  at  the  appropriate  level. 

4.  Monitoring  the  status  of  CAP  implementation.  Federal  internal 
control  standards  state  that  the  resolution  process  begins  when  audit 
or  other  review  results  are  reported  to  management,  and  is  completed 
only  after  action  has  been  taken  that  (1)  corrects  identified 
deficiencies,  (2)  produces  improvements,  or  (3)  demonstrates  that  the 
findings  and  recommendations  do  not  warrant  management  action. 
The  Implementation  Guide  for  OMB  Circular  A-1 23  states  that  an 
entity’s  senior  management  council,  or  similar  forum(s),  has 
ownership  and  accountability  for  resolving  deficiencies.  These  forums 
should  use  CAPs  as  a  guide  or  road  map  for  discussion  as  well  as  in 
determining  when  sufficient  action  has  been  taken  to  declare  that  a 
deficiency  has  been  corrected. 
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According  to  DOD’s  FIAR  Guidance,  management’s  process  for 
resolution  and  corrective  action  of  identified  material  weaknesses  in 
internal  control  must  do  the  following: 

•  Provide  for  appointment  of  an  overall  corrective  action 
accountability  official  from  senior  agency  management.  The 
official  should  report  to  the  agency’s  senior  management  council, 
if  applicable. 

•  Maintain  accurate  records  of  the  status  of  the  identified  material 
weaknesses  through  the  entire  process  of  resolution. 

•  Assure  that  CAPs  are  consistent  with  laws,  regulations,  and  DOD 
policy. 

•  Assure  that  performance  appraisals  of  appropriate  officials  reflect 
effectiveness  in  resolving  or  implementing  corrective  actions  for 
identified  material  weaknesses. 

The  FIAR  Guidance  further  states  that  a  determination  that  a 
deficiency  has  been  corrected  should  be  made  only  when  sufficient 
corrective  actions  have  been  taken  and  the  desired  results  achieved. 
This  determination  should  be  in  writing  and,  along  with  other 
appropriate  documentation  supporting  the  determination,  should  be 
available  for  review  by  appropriate  officials. 

After  comparing  the  criteria  under  the  four  elements  above  with  the 
design  of  the  Army,  Navy,  and  Air  Force  policies  and  procedures  for 
tracking  and  resolving  audit  findings,  we  found  that  while  Navy  had 
sufficiently  drafted  policies  and  procedures  to  address  three  out  of  the 
four  elements,  the  Army’s  and  Air  Force’s  policies  and  procedures  did  not 
sufficiently  address  any  of  the  four  elements,  as  detailed  below. 


Army’s  Process  for 
Addressing  Financial 
Management-Related 
Audit  Findings  and 
Recommendations  Was 
Not  Comprehensive 


The  Army’s  process  for  managing  the  remediation  of  financial 
management  deficiencies  was  not  comprehensive,  and  portions  of  it  were 
evolving  as  it  began  to  address  the  financial  management-related  findings 
and  recommendations  from  the  fiscal  year  2015  Budgetary  Schedule 
audit.  The  Army’s  regulation  regarding  audits  of  the  Army  includes 
general  guidance  establishing  responsibility  for  responding  to  audit 
findings  from  different  sources,  such  as  the  Army  Audit  Agency,  DOD 
OIG,  GAO,  and  IPAs.34  This  regulation  primarily  focuses  on  the  role  of  the 

34U.S.  Army,  Audit  Services  in  the  Department  of  the  Army,  Army  Regulation  36-2 
(Washington,  D.C.:  Oct.  30,  2015). 
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Army  Audit  Agency  and  states  that  the  Army  Audit  Agency  is  responsible 
for  forwarding  external  audit  reports  to  the  appropriate  principal  Army 
official  who  has  responsibility  for  responding  to  a  given  report.35  In 
addition,  the  Army  organization  with  overall  responsibility  for  the  results 
from  the  Budgetary  Schedule  audit  has  its  own  policies  and  procedures 
for  responding  to  audit  recommendations.  However,  the  Army  lacks 
procedures  for  reasonably  assuring  that  it  identifies  and  tracks  all 
financial  management  findings  and  recommendations.  In  addition,  the 
Army’s  policies  and  procedures  (1)  did  not  provide  sufficient  details  on 
how  to  prioritize  financial  management  findings  and  recommendations, 
(2)  were  not  consistent  with  the  Implementation  Guide  for  OMB  Circular 
A-123  for  developing  CAPs,  and  (3)  did  not  sufficiently  describe  how  the 
status  of  corrective  actions  should  be  monitored. 


Army’s  Procedures  for  The  status  of  each  open  finding  and  recommendation  pertaining  to  Army 

Identifying  and  Tracking  Open  financial  management  issues  is  supposed  to  be  tracked  by  one  of  two 
Audit  Findings  and  organizations.  Specifically,  under  the  Assistant  Secretary  of  the  Army, 

Recommendations  Vary  and  Financial  Management  and  Comptroller  (ASA(FM&C)),  (1 )  the 
Are  Incomplete  Accountability  and  Audit  Readiness  Directorate  (hereafter  referred  to  as 

the  Audit  Readiness  Directorate)  is  responsible  for  tracking  findings  and 
recommendations  from  the  Budgetary  Schedule  audit,  as  well  as  other 
financial  statement-related  audits  and  audit  readiness  activities,  and 
(2)  the  Internal  Review  Directorate  is  responsible  for  tracking  other 
financial  management-related  findings  and  recommendations,  primarily 
from  the  DOD  OIG  and  GAO  but  also  some  from  the  Army  Audit  Agency, 
that  pertain  to  the  ASA(FM&C).  When  they  receive  new  audit 
recommendations,  each  of  these  directorates  determines  which  Army 
organization  is  responsible  for  addressing  each  recommendation  under 
its  purview. 

We  reviewed  the  tracking  procedures  for  each  of  these  directorates  and 
found  that  they  varied.  Specifically,  the  Audit  Readiness  Directorate  uses 
a  spreadsheet  called  a  CAP  tracker  to  keep  track  of  the  hundreds  of 
findings  and  recommendations  issued  during  the  audit  of  the  Army’s  fiscal 


35The  Army  Audit  Agency  was  established  on  November  12,  1946,  to  perform  internal 
auditing  services  on  an  Army-wide  basis.  The  Goldwater-Nichols  Department  of  Defense 
Reorganization  Act  of  1 986  placed  the  Army  Audit  Agency  under  the  jurisdiction  of  the 
Secretary  of  the  Army.  Pub.  L.  No.  99-433,  100  Stat.  992  (Oct.  1,  1986).  The  Army  Audit 
Agency  is  responsible  for  internal  audit  services  throughout  the  Department  of  the  Army, 
including  audit  policy,  training,  follow-up,  and  liaison  with  external  audit  organizations. 
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year  2015  Budgetary  Schedule,  as  well  as  the  status  of  CAPs  developed 
to  remediate  them.  During  our  audit,  we  looked  at  the  CAP  tracker  in 
March  2016  and  found  that  it  consisted  primarily  of  findings  and 
recommendations  from  the  Budgetary  Schedule  audit,  but  also  included 
two  findings  and  recommendations  each  from  the  DOD  OIG  and  the  Army 
Audit  Agency.  These  other  recommendations  were  included  in  the  CAP 
tracker  because  they  also  pertained  to  audit  readiness  issues.  The  CAP 
tracker  is  mentioned  in  the  Audit  Readiness  Directorate’s  Standard 
Operating  Procedure  (SOP)  for  follow-up  actions  needed  to  respond  to 
financial  statement  audits  and  other  audit  readiness  activities,  which  it 
finalized  in  May  2016.  However,  the  SOP  does  not  provide  any  details 
about  what  information  for  each  finding  and  recommendation  should  be  in 
the  CAP  tracker,  such  as  interim  milestones  and  outcome  measures. 

The  Internal  Review  Directorate  also  uses  a  spreadsheet  to  track  the 
findings  and  recommendations  that  it  is  responsible  for  tracking. 

However,  according  to  an  Internal  Review  Directorate  official,  the 
directorate  did  not  have  an  SOP  or  other  written  policies  and  procedures 
pertaining  to  its  tracking  of  audit  recommendations  or  to  any  other  aspect 
of  managing  the  audit  remediation  process  and  related  corrective  actions 
to  address  them.  While  reviewing  the  CAP  tracker  in  March  2016,  we 
identified  42  unresolved  recommendations  related  to  financial 
management  that  resulted  from  prior  audits  conducted  by  the  Army  Audit 
Agency,  the  DOD  OIG,  and  GAO  and  that  should  have  been  tracked  by 
the  Internal  Review  Directorate.  We  found  that  as  of  August  2016,  the 
Internal  Review  Directorate  was  tracking  37  of  these  recommendations 
while  the  other  5  open  recommendations  were  not  included  in  its  tracker. 
An  Internal  Review  Directorate  official  said  that  these  5 
recommendations,  all  of  which  stemmed  from  a  GAO  report  from  fiscal 
year  2013,  were  made  before  he  began  working  in  the  directorate,  and 
therefore,  he  did  not  know  why  they  were  not  included.36  According  to  this 
official,  neither  the  Internal  Review  Directorate  nor  anyone  else  within 
ASA(FM&C)  had  established  procedures  to  ensure  that  all  financial 
management-related  recommendations  were  being  tracked  within  this 
organization. 

Without  policies  and  procedures  that  clearly  specify  how  audit  findings 
and  recommendations  should  be  tracked  and  which  types  of  findings  and 


36The  audit  report  for  which  the  recommendations  were  not  being  tracked  was  GAO,  DOD 
Financial  Management:  Actions  Needed  to  Address  Deficiencies  in  Controls  over  Army 
Active  Duty  Military  Payroll,  GAO-13-28  (Washington,  D.C.:  Dec.  12,  2012). 
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recommendations  should  be  tracked  by  each  of  the  two  Army 
organizations  described  above — the  Audit  Readiness  Directorate  and  the 
Internal  Review  Directorate — it  can  be  difficult  to  hold  either  organization 
accountable  and  reasonably  assure  that  procedures  are  followed 
consistently,  particularly  when  there  is  staff  turnover.  If  findings  and 
recommendations  are  overlooked  and  do  not  get  tracked  by  either 
organization,  they  are  less  likely  to  be  remediated  in  a  timely  manner  or 
possibly  at  all. 


The  Audit  Readiness  Directorate’s  SOP  includes  general  guidance  for 
prioritizing  audit  findings  that  is  based  on  direction  and  criteria  outlined  in 
the  FIAR  Guidance.  Specifically,  the  SOP  cites  the  following  criteria  for 
prioritization:  severity  of  deficiencies  (material  weakness  or  significant 
deficiency);  designation  as  a  FIAR  deal-breaker;  findings  that  reference  a 
documentation  gap;  findings  that  are  pervasive  across  business 
processes;  and  finding  sensitivity  (e.g.,  failure  of  good  stewardship  of 
government  resources).37  However,  the  SOP  does  not  identify  which  of 
the  criteria  might  be  a  higher  priority  than  others.  Consequently,  if  the 
Audit  Readiness  Directorate  followed  the  SOP  criteria  for  prioritization, 
most  of  the  over  200  Budgetary  Schedule  audit  findings  would  be 
considered  a  priority,  which  would  defeat  the  intent  of  identifying  priorities. 
To  avoid  this,  Army  officials  said  that  based  on  input  from  the  I  PA  they 
decided  to  narrow  the  criteria  for  prioritizing  the  Budgetary  Schedule 
findings  and  recommendations  to  those  related  to  the  critical  areas  of 
completeness,  documentation,  Fund  Balance  with  Treasury,38  and 

37Drawing  on  lessons  learned  from  past  audit  readiness  efforts,  DOD  compiled  a  list  of 
deal-breakers  that  have  prevented  it  from  demonstrating  audit  readiness  or  receiving 
unmodified  or  “clean”  opinions  in  audits.  As  a  subset  of  these  deal-breakers,  DOD  has 
identified  several  critical  capabilities  that  reporting  entities  must  demonstrate  prior  to 
asserting  full  audit  readiness.  According  to  the  April  2016  FIAR  Guidance,  these  seven 
critical  capabilities  are  DOD’s  ability  to  (1)  produce  a  universe  of  transactions; 

(2)  reconcile  Fund  Balance  with  Treasury  (i.e.,  balance  its  checkbook);  (3)  provide 
supporting  documentation  for  material  adjustments  to  its  financial  records;  (4)  validate  the 
existence,  completeness,  rights,  and  obligations  of  its  assets;  (5)  establish  processes  to 
manage  and  value  its  assets  correctly;  6)  establish  an  auditable  process  for  estimating 
and  recording  its  environmental  and  disposal  liabilities;  and  (7)  implement  critical 
information  technology  controls  for  its  financial  systems. 

OQ 

In  the  federal  government,  an  agency’s  Fund  Balance  with  Treasury  account  is  similar  in 
concept  to  a  corporate  bank  account.  The  difference  is  that  instead  of  a  cash  balance, 
Fund  Balance  with  Treasury  represents  unexpended  spending  authority  in  appropriation 
accounts.  Similar  to  bank  accounts,  the  funds  in  DOD’s  appropriation  accounts  must  be 
reduced  or  increased  as  the  department  spends  money  or  receives  collections  that  it  is 
authorized  to  retain  for  its  own  use. 
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information  systems.  Using  these  criteria,  Army  officials  said  they 
identified  specific  findings  and  recommendations,  and  the  related  CAPs, 
as  high  priority.  These  criteria  are  a  subset  of  the  criteria  in  the  Audit 
Readiness  Directorate’s  SOP  as  these  issues  were  reported  as  material 
weaknesses  by  the  I  PA  and  three  of  the  four  areas  are  also  considered 
deal-breakers  in  the  FIAR  Guidance.  However,  these  more  narrow  criteria 
are  not  yet  included  in  the  Audit  Readiness  Directorate’s  SOP. 

The  Internal  Review  Directorate  does  not  have  any  policies  or  procedures 
for  prioritizing  the  audit  recommendations  that  it  tracks.  Instead, 
according  to  a  directorate  official,  the  action  officers  responsible  for 
specific  recommendations  are  in  the  best  position  to  determine  priorities 
as  they  are  more  familiar  with  the  conditions  that  generated  each 
recommendation.  Without  sufficiently  detailed  policies  and  procedures  for 
consistently  and  systematically  prioritizing  audit  findings,  the  Army  is  at 
increased  risk  of  not  identifying  and  focusing  its  efforts  on  its  most  critical 
financial  management  weaknesses,  and  thereby  not  taking  the  steps 
necessary  to  resolve  them  at  the  earliest  possible  date. 


Only  one  of  the  two  Army  organizations  responsible  for  remediating  audit 
findings  had  documented  guidance  for  developing  CAPs.  The  Audit 
Readiness  Directorate’s  SOP  describes  the  procedures  for  developing 
CAPs  to  address  findings  from  financial  statement  audits  and  audit 
readiness  activities.  For  example,  it  states  that  the  Army  official 
responsible  for  developing  a  CAP  should  identify  the  root  cause  of  the 
finding  related  to  the  CAP.  It  also  states  that  CAPs  should  be  developed 
using  the  format  and  template  provided  by  the  Audit  Readiness 
Directorate.  This  template  includes  most  of  the  elements  recommended  in 
the  Implementation  Guide  for  OMB  Circular  A-1 23,  including  a  description 
of  the  deficiency,  the  responsible  official,  interim  milestones,  outcome 
measures,  and  an  estimated  completion  date. 

However,  the  Internal  Review  Directorate  does  not  have  any  policies 
requiring  the  development  of  CAPs  or  any  other  procedures  that  should 
be  followed  to  remediate  the  audit  recommendations  that  it  tracks, 
according  to  a  directorate  official.  Instead,  the  official  said  that  after  the 
Internal  Review  Directorate  forwards  a  report  to  an  action  officer  for 
remediation,  the  action  officer  will  provide  the  directorate  an  estimated 
completion  date  for  each  recommendation  that  the  officer  is  responsible 
for.  When  responsible  organizations  or  officials  believe  that 
recommendations  have  been  remediated,  they  send  descriptions  of  the 
actions  taken  to  the  Internal  Review  Directorate  with  messages  indicating 
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that  the  recommendations  can  be  closed.  These  procedures  were  not 
documented  and  do  not  include  the  elements  recommended  in  the 
Implementation  Guide  for  OMB  Circular  A-1 23.  Without  documented 
procedures  for  developing  CAPs  for  all  audit  findings,  the  Army  is  at 
increased  risk  of  not  developing  CAPs  for  all  findings  or  developing  CAPs 
that  do  not  include  all  necessary  elements. 


Once  a  plan  for  a  corrective  action  is  complete,  the  CAP  is  expected  to  be 
carried  out  and  monitored  by  senior  management,  as  recommended  by 
the  Implementation  Guide  for  OMB  Circular  A-1 23.  According  to  Army 
officials,  any  detailed  documentation  of  CAP  implementation  is 
maintained  by  the  person  responsible  for  carrying  out  the  plan.  We  found 
that  this  was  the  case  for  the  remediation  of  all  financial  management- 
related  recommendations,  whether  they  fell  under  the  responsibility  of  the 
Audit  Readiness  Directorate  or  the  Internal  Review  Directorate. 

Because  the  Internal  Review  Directorate  does  not  require  CAPs  for  the 
audit  recommendations  under  its  purview,  it  also  does  not  monitor  the 
status  of  CAP  implementation.  Rather,  it  only  maintains  information  about 
when  the  corrective  actions  for  a  given  audit  recommendation  are 
considered  complete  and  the  recommendation  can  therefore  be  closed. 

For  the  audit  recommendations  that  fall  under  the  Audit  Readiness 
Directorate,  the  directorate’s  SOP  states  that  the  directorate  is 
responsible  for  monitoring  the  progress  of  the  CAPs  and  provides  some 
information  on  how  the  monitoring  should  be  conducted.  For  example,  it 
states  that  monitoring  is  carried  out  via  regularly  scheduled  meetings 
during  which  the  senior  responsible  officials  for  each  CAP  provide 
briefings  about  the  status  of  corrective  actions.  The  SOP  mentions  the 
following  types  of  meetings: 

•  Synchronization  calls  are  held  weekly  between  the  Audit  Readiness 
Directorate  and  one  of  two  different  groups  that  alternate  every  other 
week.  According  to  Army  officials,  one  group  includes  the  Enterprise 
Resource  Planning  (ERP)39  managers,  feeder  system  managers,  and 
DFAS,  while  the  other  group  includes  the  Army  commands — that  is, 
business  process  areas. 


oq 

An  ERP  system  is  an  automated  system  using  commercial  off-the-shelf  software 
consisting  of  multiple,  integrated  functional  modules  that  perform  a  variety  of  business- 
related  tasks,  such  as  general  ledger  accounting,  payroll,  and  supply  chain  management. 
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•  The  Army  Audit  Committee  meets  bimonthly  and  is  chaired  by  the 
ASA(FM&C).  Army  officials  told  us  that  these  meetings  include  all  of 
the  Deputy  ASAs,  Army  principals  and  major  commands,  as  well  as 
DOD  management  such  as  the  DCMO  and  officials  from  the  DOD 
Comptroller’s  office,  including  the  Deputy  Chief  Financial  Officer. 

However,  the  SOP  does  not  provide  complete  information  about  all  of  the 
monitoring  activities  that  take  place.  For  example,  Army  officials  told  us 
that  monitoring  of  the  CAPs  takes  place  at  other  meetings  as  well, 
although  these  meetings  are  not  described  in  the  SOP.  These  meetings 
included  the  following: 

•  The  Senior  Level  Steering  Group/Senior  Assessment  Team,  which 
represents  senior  Army  management  responsible  for  monitoring 
development  and  implementation  of  the  CAPs.  This  group  meets 
quarterly  with  Army  commands  and  service  providers  to  review  the 
status  of  the  CAPs. 

•  Audit  Status  Update  meetings,  which  are  held  biweekly,  and  during 
which  the  Audit  Readiness  Directorate  provides  updates  to  the  Army 
Comptroller. 

•  Audit  Readiness  Directorate’s  “Stand-Up”  meetings,  which  are  held 
twice  a  week  to  communicate  with  the  field  on  the  status  of  the  CAPs. 
One  meeting  per  week  focuses  on  Budgetary  Schedule  issues,  while 
the  other  meeting  focuses  on  the  Balance  Sheet. 

According  to  Army  officials,  any  decisions  or  action  items  resulting  from 
these  various  meetings  are  documented,  but  we  found  that  the 
requirements  for  documenting  such  decisions  are  not  included  in  the 
Army’s  SOP. 

Further,  the  Army’s  SOP  did  not  describe  or  include  specific  procedures 
for  the  preparation  of  “scorecards”  that  the  Audit  Readiness  Directorate 
uses  to  monitor  the  status  of  CAPs.  These  scorecards  provide  an 
overview  of  the  status  of  CAPs  at  status  meetings  and  other  management 
oversight  meetings.  Army  officials  told  us  that  a  scorecard  is  prepared  for 
the  development  of  each  high-priority  CAP  and  indicates  both  the 
organization  and  the  individual  responsible  for  developing  and 
implementing  the  CAP,  as  well  as  estimated  and  actual  dates  for 
completion  of  the  CAP.  After  a  CAP  has  been  developed,  the  Army  uses 
another  scorecard  to  monitor  the  execution  of  the  CAP.  This  scorecard 
includes  some  of  the  same  information  as  the  development  scorecard, 
but  instead  of  CAP  completion  dates,  it  includes  estimated  and  actual 
dates  for  the  execution  and  validation  of  each  CAP.  According  to  Army 
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officials,  the  scorecards  are  updated  every  2  weeks.  However,  the 
scorecards  do  not  include  any  interim  milestones  or  other  metrics  that 
could  be  used  to  gauge  progress  or  any  outcome  measures  for  assessing 
the  effectiveness  of  corrective  actions.  These  types  of  metrics  are  an 
important  tool  for  monitoring  the  status  of  CAPs.  Instead  of  metrics,  each 
scorecard  uses  color-coded  symbols  (i.e.,  red,  yellow,  blue,  and  green)  to 
indicate  the  status  of  each  CAP.  For  example,  to  indicate  the  status  of 
CAP  execution,  green  indicates  that  a  CAP’S  execution  has  been 
completed,  while  blue  indicates  that  the  completed  CAP  execution  has 
been  validated  by  an  independent  party. 

The  SOP  states  that  the  Audit  Readiness  Directorate  will  use  a  CAP 
tracker  to  track  the  progress  of  CAP  development  and  implementation. 
However,  as  discussed  previously,  it  does  not  provide  any  details  about 
what  should  be  in  the  CAP  tracker.  For  example,  the  SOP  does  not 
specify  which  findings  and  recommendations,  and  related  CAPs,  should 
be  included  in  the  tracker.  It  also  does  not  describe  what  information 
should  be  maintained  in  the  tracker  for  each  CAP.  We  obtained  periodic 
updates  of  the  CAP  tracker  and  determined  that  while  the  tracker 
contained  most  of  the  elements  recommended  in  the  Implementation 
Guide  forOMB  Circular  A-1 23,  it  did  not  include  any  interim  milestones  or 
other  metrics  that  could  be  used  to  gauge  progress,  even  though  many  of 
the  CAPs  themselves  did.  In  addition,  similar  to  the  CAPs,  the  CAP 
tracker  did  not  include  any  outcome  measures  for  assessing  the 
effectiveness  of  corrective  actions. 

While  the  Audit  Readiness  Directorate  has  an  SOP  that  has  some 
information  about  its  monitoring  procedures,  it  lacks  certain  details  about 
procedures  that  are  being  performed  as  well  as  other  monitoring 
procedures  that  should  be  performed.  Moreover,  the  Internal  Review 
Directorate  does  not  have  any  SOP  regarding  such  procedures.  Without 
complete  policies  and  procedures  to  describe  all  aspects  of  the  Army’s 
process  for  monitoring  the  implementation  status  of  CAPs,  the  Army  is  at 
increased  risk  that  information  about  the  status  of  CAPs  will  not  be 
adequately  documented  and  monitored. 
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Navy’s  Process  for  Identifying 
and  Tracking  Open  Audit 
Findings  and 

Recommendations  Results  in 
Omissions  and  Inconsistencies 


Prior  to  April  2015,  the  Navy  had  a  decentralized  approach  for  identifying 
and  tracking  its  findings  and  recommendations  from  audits  or 
examinations,  with  primary  responsibility  for  these  activities  assigned  to 
the  specific  Navy  program  area  under  audit.  In  April  2015,  in  anticipation 
of  the  notices  of  findings  and  recommendations  that  the  Navy  expected 
would  be  issued  as  a  result  of  the  Budgetary  Schedule  audit,  the  Navy’s 
Office  of  Financial  Operations  established  the  Evaluation,  Prioritization, 
and  Remediation  (EPR)  Program.  The  purpose  of  this  program  is  to  build 
a  centralized  capability  to  manage  and  track  known  deficiencies  (reported 
from  both  internal  and  external  sources)  and  manage  the  related 
remediation  process  across  the  Navy.  As  part  of  the  effort,  the  Navy 
drafted  several  SOPs  for  implementing  its  various  remediation  activities. 
Although  the  Navy  has  not  finalized  the  SOPs  related  to  this  process,  the 
draft  guidance  includes  processes  to  identify  and  track  its  financial 
management-related  deficiencies,  prioritize  its  audit  findings  and 
recommendations,  develop  CAPs  to  address  these  deficiencies,  and 
monitor  and  report  its  findings  and  recommendations. 

While  the  design  of  these  processes  is  generally  consistent  with  the 
Implementation  Guide  for  OMB  Circular  A-123,  the  Navy’s  draft  guidance 
for  identifying  and  tracking  findings  from  external  sources  such  as  DOD 
OIG  and  GAO  and  from  the  Naval  Audit  Service  does  not  include  specific 
details  and  procedures  for  reasonably  assuring  the  (1)  completeness  of 
the  universe  of  audit  findings  and  recommendations  from  these  sources 
and  (2)  accuracy  of  the  status  of  these  audit  findings  and 
recommendations,  as  discussed  in  detail  below.  Navy  officials  told  us  that 
they  plan  to  finalize  the  draft  SOPs  by  December  31 , 2016. 


The  Navy  drafted  its  EPR  Program:  Deficiency  Universe  Guide  to 
describe  its  process  to  centrally  identify  and  track  its  financial 
management-related  findings  and  recommendations  from  both  internal 
and  external  sources.  This  draft  guide  includes  procedures  on  steps  the 
Navy  is  taking  to  gather  data  from  internal  and  external  stakeholders,  the 
data  structure  used,  activities  to  preserve  the  monthly  integrity  of  these 
data,  and  the  reporting  requirements  for  keeping  the  information  updated. 

The  Navy  uses  a  detailed  spreadsheet,  called  a  Deficiency  Universe 
Tracker  (tracking  spreadsheet),  to  keep  track  of  the  over  200  notices  of 
findings  resulting  from  the  Budgetary  Schedule  audit,  as  well  as  to 
monitor  the  status  of  the  related  CAPs.  The  tracking  spreadsheet  also 
tracks  deficiencies  identified  from  other  sources,  such  as  GAO,  DOD 
OIG,  and  the  Naval  Audit  Service. 
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During  our  audit,  we  analyzed  the  tracking  spreadsheet  provided  by  the 
Navy  in  July  2016  and  identified  differences  between  the  number  of  audit 
reports  listed  and  the  status  of  the  deficiencies  reported  by  the  Navy  on 
its  tracking  spreadsheet,  and  with  the  number  of  reports  listed  and  the 
status  of  the  deficiencies  identified  by  GAO,  the  DOD  OIG,  and  the  Naval 
Audit  Service.  For  example,  our  analysis  of  the  DOD  OIG  audit  reports 
listed  on  the  Navy’s  July  2016  tracking  spreadsheet  found  that  there  was 
a  DOD  OIG  report  that  was  issued  in  fiscal  year  2015  with  5  open 
financial  management-related  recommendations  that  was  omitted  from 
the  Navy’s  tracking  spreadsheet.  Our  analysis  of  the  tracking  spreadsheet 
also  found  that  the  Navy  was  tracking  9  open  financial  management- 
related  recommendations  from  three  DOD  OIG  reports  that  were  issued 
in  fiscal  year  2015.  However,  a  report  we  received  from  the  DOD  OIG’s 
recommendation  tracking  system  showed  that  the  DOD  OIG  was  tracking 
10  open  financial  management-related  recommendations  from  these 
same  three  reports.  With  regard  to  the  DOD  OIG  report  that  was  not 
entered  into  the  tracking  spreadsheet,  Navy  officials  told  us  that  they 
were  focused  on  addressing  the  notice  of  findings  and  recommendations 
and  did  not  enter  this  report.  A  Navy  official  also  told  us  that  going 
forward  the  Navy  will  review  and  update  the  tracking  spreadsheet  to 
account  for  this  DOD  OIG  report  and  will  also  review  other  reports  to  help 
ensure  the  completeness  of  its  tracking  spreadsheet. 

With  regard  to  the  status  of  DOD  OIG  deficiencies  the  Navy  was  tracking, 
Navy  officials  told  us  that  they  aggregate  the  recommendations  from  each 
DOD  OIG  report  into  one  data  field  on  their  tracking  spreadsheet. 
Therefore,  all  3  recommendations  from  a  DOD  OIG  report  will  be  listed  in 
one  data  field  (not  three  data  fields)  on  the  tracking  spreadsheet.  This 
approach  makes  it  difficult  to  determine  the  status  of  each 
recommendation  separately  and  may  result  in  inaccurate  reporting  by  the 
Navy  on  the  status  of  each  audit  recommendation.  Another  complication 
with  this  approach  is  that  it  will  be  difficult  to  assess  the  Navy’s  progress 
in  addressing  those  DOD  OIG  recommendations  that  are  identified  in  the 
DOD  OIG  report  as  one  recommendation,  yet  have  multiple  steps  listed 
within  that  recommendation. 

We  believe  that  the  omission  of  the  DOD  OIG  audit  report  and  the 
inconsistencies  of  the  status  of  the  deficiencies  reported  by  the  Navy  on 
its  tracking  spreadsheet  occurred  because  the  Navy’s  process  for 
obtaining,  consolidating,  monitoring,  and  updating  its  audit  findings  from 
the  DOD  OIG,  which  involves  conducting  a  monthly  online  search  of  audit 
reports,  is  not  properly  designed.  Relying  on  a  monthly  online  search  of 
DOD  OIG  audit  reports  without  periodically  confirming  with  the  external 
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auditor  (the  DOD  OIG  in  this  example)  that  the  (1 )  list  of  reports  is 
complete  and  (2)  status  of  audit  findings  and  recommendations  being 
tracked  is  consistent  could  result  in  incomplete  and  inconsistent 
information  being  reported  on  the  Navy’s  tracking  spreadsheet. 
Furthermore,  according  to  the  Navy’s  draft  guidance,  its  process  for 
gathering  and  monitoring  audit  findings  from  GAO  and  the  Naval  Audit 
Service  is  designed  using  the  same  approach  (i.e.,  a  monthly  online 
search)  and  could  therefore  also  result  in  similar  incomplete  and 
inconsistent  information  being  reported  on  the  Navy’s  tracking 
spreadsheet. 

Without  detailed  guidance  and  specific  procedures  in  place  for  confirming 
and  validating  the  completeness  and  consistency  of  the  status  of  the 
financial  management-related  deficiencies  it  is  tracking,  the  Navy  is  at  risk 
of  reporting  incomplete  and  inconsistent  information  both  internally  and 
externally.  If  the  Navy  does  not  identify  and  track  the  status  of  the 
complete  universe  of  its  unresolved  deficiencies  related  to  financial 
management,  it  cannot  provide  reasonable  assurance  that  all  such 
deficiencies  will  be  addressed  in  a  timely  manner;  which  can  ultimately 
affect  the  reliability  of  its  financial  information  and  the  auditability  of  its 
financial  statements.  As  the  Navy  progresses  toward  a  full  financial 
statement  audit  for  fiscal  year  2018,  completely  identifying  and 
consistently  tracking  reported  audit  results  will  become  even  more 
important,  as  audit  coverage  expands  and  additional  deficiencies  may  be 
identified. 


The  Navy  drafted  its  EPR  Program'.  Deficiency  Prioritization  Standard 
Operating  Procedures  (SOP)  with  details  on  its  methodology  for 
prioritizing  audit  findings  and  recommendations  by  weighing  various 
factors,  including  the  deficiency’s  source;  deficiency  type;  organizational 
impact;  whether  it  is  a  FIAR  deal-breaker;  whether  it  is  financial  or 
information  technology  related;  whether  compensating  controls  exist;  and 
materiality,  or  the  potential  financial  statement  dollar  amount  affected  by 
the  deficiency.  According  to  the  draft  SOP,  the  EPR  prioritization  team  will 
evaluate  each  audit  finding  and  recommendation  to  identify  high-priority 
deficiencies  for  remediation.  As  part  of  this  process,  the  EPR  team 
defines  key  deficiency  data  elements,  prioritization  criteria,  methodology, 
scoring,  risk  factors,  and  qualitative  considerations  to  assess  what  factors 
to  include  in  the  final  prioritization  determination.  Our  analysis  of  the 
tracking  spreadsheet  provided  in  July  2016  showed  that  the  Navy  had 
identified  and  applied  three  prioritization  categories  (high,  medium,  and 
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low)  to  82  percent  of  the  recommendations  from  other  sources  that  were 
being  tracked. 


Our  review  of  the  template  that  the  Navy  is  using  to  develop  its  CAPs  and 
the  information  presented  on  the  tracking  spreadsheet  found  that  both  of 
these  documents  included  the  elements  recommended  in  the 
Implementation  Guide  for  OMB  Circular  A-123.  The  template  and  tracking 
spreadsheet  both  included  a  description  of  the  deficiency,  officials 
responsible  for  addressing  the  deficiency,  interim  milestones  for  the 
various  activities  and  steps  to  address  that  deficiency,  and  validation 
dates  of  when  the  CAP  process  is  complete  according  to  management. 
Although  the  template  and  tracking  spreadsheet  do  not  include  specific 
outcome  measures  for  assessing  the  effectiveness  of  the  corrective 
actions,  we  found  that  the  Navy  does  have  a  process  for  developing  and 
reporting  outcome  measures  as  outlined  in  its  draft  reporting  guidance. 

According  to  the  Navy’s  draft  EPR  Program:  Reporting  and  Reporting 
Metrics  SOP,  outcome  measures  (or  operational  reporting  metrics)  will  be 
continuously  collected  and  stored  in  the  program’s  EPR  Program 
SharePoint  Tool  and  will  be  the  data  source  used  to  create  both  periodic 
and  ad  hoc  reports  as  needed.40  Testing  results  and  other  pertinent  data 
derived  from  the  EPR’s  program  activities  will  be  collected  in  a 
standardized  format  and  stored  in  the  tool.  According  to  the  draft 
reporting  SOP,  program  metrics  that  are  tracked  may  include,  but  are  not 
limited  to,  notice  of  findings  and  recommendations  response  statuses, 
CAP  action  results,  associated  financial  impact  of  deficiencies,  and  any 
additional  reporting  information  relevant  to  effectively  presenting  the 
CAPs.  This  draft  SOP  also  provides  details  regarding  the  process  for 
approving  any  necessary  thresholds  that  reporting  metrics  or  other  data 
should  be  measured  against  for  report  creation  purposes. 

In  addition  to  the  draft  reporting  metric  SOP,  the  Navy  has  drafted  its  EPR 
Program:  Corrective  Action  Plan  Process  SOP,  which  describes 
procedures  for  adding  certain  data  elements  into  the  CAP  template  and 
tracking  spreadsheet.  This  SOP  describes  how  the  information  flows  to 
and  from  the  offices  of  primary  responsibility  or  action  officers,  system 
owners,  and  resource  managers  responsible  for  the  CAP  development 
process.  Our  review  of  the  design  of  the  Navy’s  CAP  development 

40SharePoint  is  a  web  application  platform  used  by  organizations  to  create  websites  and 
can  be  used  to  store,  organize,  share,  and  access  information. 
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process  found  that  it  is  consistent  with  guidance  in  the  Implementation 
Guide  for  OMB  Circular  A-1 23.  The  Navy’s  approach  to  CAP 
development  involves  a  phased  approach  (i.e. ,  planning  and  design, 
implementation,  validation,  and  closeout);  a  description  of  the  root  cause 
analysis;  an  analysis  of  alternative  CAPs;  whether  system  or  process 
changes  are  required;  whether  policy  updates  are  necessary;  and 
whether  additional  resources  are  needed  to  implement  the  CAPs.  If 
effectively  implemented,  the  Navy’s  design  for  developing  CAPs  should 
provide  it  with  information  on  the  needed  steps  or  activities  for  addressing 
identified  deficiencies. 


We  found  that  the  design  for  monitoring  the  status  of  corrective  action 
implementation  at  the  Navy  involves  several  layers  of  management 
oversight  and  collaboration  and  various  reporting  activities.  According  to 
its  draft  EPR  Guidebook,  one  of  the  Navy’s  objectives  for  centralizing  its 
remediation  efforts  and  establishing  the  EPR  Program  is  to  facilitate  a 
culture  of  collaboration,  integration,  and  accountability  across  the  Navy  in 
support  of  its  auditability  milestones.  To  this  end,  the  Navy  has 
established  its  Senior  Management  Council  at  the  most  senior  Navy 
management  level  comprising  senior  executive  civilians  and  flag 
officers.41  According  to  its  charter,  the  council  is  responsible  for 
monitoring,  assessing,  and  reporting  to  the  Assistant  Secretary  of  the 
Navy,  Financial  Management  and  Comptroller  on  the  implementation  of 
corrective  actions  to  ensure  that  they  are  accurate  and  timely,  and 
reporting  the  results  of  CAP  implementation.  At  a  minimum,  this  council 
meets  quarterly  each  year,  in  part  to  review  the  Navy’s  progress  in 
correcting  previously  identified  material  weaknesses.  In  addition  to 
periodic  monitoring  at  the  Navy’s  senior  management  level,  the  Navy  has 
identified  other  key  personnel  in  its  Office  of  Financial  Operations  who 
play  critical  roles  in  ongoing  monitoring  of  its  remediation  efforts.  These 
key  personnel  are  the  office  of  primary  responsibility  and  the  responsible 
action  officer. 

•  Office  of  primary  responsibility.  The  office  of  primary  responsibility 
is  a  senior  executive  civilian  or  flag  officer  responsible  for  facilitating 
the  collaboration  and  communication  necessary  for  the  engagement 


41 

Flag  officers  are  the  leaders  of  the  Navy  at  the  rank  of  rear  admiral  and  above.  These 
are  the  equivalent  of  general  officers,  which  are  officers  at  the  rank  of  brigadier  general 
and  above  for  the  Army,  the  Air  Force,  and  the  Marine  Corps,  and  make  up  less  than  a 
tenth  of  a  percent  of  the  active  duty  force. 
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of  senior  leaders  and  major  stakeholders  supporting  CAP 
development  and  resource  identification  as  needed.  This  person  is  the 
primary  point  of  contact  and  driver  for  remediating  a  deficiency  and 
should  have  the  knowledge  to  assess  the  root  cause  of  the  deficiency. 

•  Action  officer.  The  action  officer  is  generally  more  at  the  working 
level  and  is  responsible  for  hands-on  remediation  of  a  deficiency,  and 
should  have  a  strong  understanding  of  the  mission  needs  and 
capabilities.  This  officer’s  tasks  include  conducting  a  root  cause 
analysis  of  the  deficiency,  implementing  and  sustaining  the  CAPs,  and 
reporting  on  the  CAPs’  status. 

To  facilitate  collaboration  for  addressing  its  remediation  activities,  the 
Navy  also  holds  recurring  meetings  attended  by  the  EPR  Program  team 
and  Navy  senior  leadership  to  discuss  CAP  progress  and  milestones 
accomplished.  According  to  Navy  officials,  the  purpose  of  these  meetings 
is  to  help  drive  accountability  for  CAPs,  address  potential  challenges,  and 
increase  transparency  in  the  EPR  process.  Navy  officials  told  us  that  the 
EPR  team  meets  regularly  to  assess  prioritized  deficiencies  for  action, 
discuss  updates  on  CAP  progress,  and  identify  risks  as  reported  by  the 
office  of  primary  responsibility.  According  to  Navy  officials,  monthly 
meetings  are  also  held  with  the  Assistant  Secretary  of  the  Navy,  Financial 
Management  and  Comptroller,  and  the  Navy’s  Office  of  Financial 
Operations  senior  management  to  review  CAP  status,  approve  CAP 
implementation,  assess  identified  risks,  and  evaluate  CAP  mitigation 
plans  as  needed. 

As  discussed  earlier,  to  provide  guidance  on  the  Navy’s  reporting 
activities  on  the  status  of  its  CAPs,  the  Navy  drafted  an  EPR  Program: 
Reporting  and  Reporting  Metrics  SOP.  This  SOP  establishes  guidelines, 
policies,  and  procedures  for  the  EPR  Program  to  follow  when  creating 
reports  and  reporting  metrics  across  program  activities.  According  to  this 
draft  SOP,  performing  these  procedures  will  help  provide  a  high  level  of 
data  integrity  and  minimize  gaps  of  information  across  the  Navy.  The  draft 
SOP  also  states  that  all  of  the  aggregated  CAP,  deficiency,  and  findings 
and  recommendations  data  will  be  stored  in  the  EPR  Program  SharePoint 
Tool.  This  tool  will  serve  as  the  source  for  all  reporting  and  reporting 
metrics  required  by  the  EPR  Program  and  will  assist  the  EPR  program 
manager  in  developing  accurate  reports  and  reporting  metrics,  when 
needed. 

The  Navy  also  drafted  the  EPR  Program :  CAP  Validation  SOP  that 
establishes  guidelines,  policies,  and  procedures  to  validate  CAPs  and 
deficiencies  through  testing  to  determine  if  deficiencies  have  been 
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remediated  and  the  corrective  actions  are  operating  effectively.  This  SOP 
provides  details  on  the  CAP  validation’s  objectives,  roles  and 
responsibilities,  and  procedures.  Results  from  the  CAP  validation  process 
are  compiled  and  reported  in  a  CAP  Testing  Results  Report  and  reported 
to  the  Navy’s  Office  of  Financial  Operations.  This  report  includes  the 
testing  scope,  pass  rates,  and  recommendations  for  improvement. 

The  Navy’s  draft  guidance  provides  details  on  the  roles  and 
responsibilities,  level  of  collaboration  needed,  and  reporting  framework 
that  if  implemented  effectively  should  allow  Navy  management  to 
sufficiently  monitor  implementation  progress  of  its  CAPs. 


Air  Force  Did  Not  Design  a 
Comprehensive  Process 
for  Addressing  Financial 
Management-Related 
Audit  Findings  and 
Recommendations 


The  Air  Force  did  not  have  a  comprehensive  process  in  place  to  identify 
and  track  all  financial  management-related  findings  and 
recommendations.  The  Air  Force  had  written  policies  and  procedures 
providing  limited  information  for  selected  recommendations,  such  as 
those  from  the  Air  Force  Audit  Agency  (AFAA),  but  the  policies  did  not 
discuss  the  development  of  CAPs.  The  Air  Force’s  written  policies  and 
procedures  did  not  provide  specific  details  to  support  how 
(1)  recommendations  from  all  audit  sources  are  identified  and  prioritized 
for  tracking  purposes,  (2)  CAPs  are  developed  for  these 
recommendations,  and  (3)  CAPs  are  implemented  and  monitored.  The  Air 
Force  provided  guidance  in  the  June  2016  CAPs  Process  Guide42 
describing  the  Air  Force’s  process  for  developing  and  implementing  CAPs 
to  remediate  self-identified  deficiencies  and  its  over  200  findings  and 
recommendations  issued  by  the  IPA  during  the  fiscal  year  2015 
Budgetary  Schedule  audit.43  This  guidance  describes  at  a  high  level  the 
CAP  development  and  implementation  process,  responsible 
organizations/stakeholders,  and  the  steps  required  of  each  responsible 
party.  However,  even  this  guidance  did  not  provide  the  information  to 
resolve  all  the  limitations  we  identified. 


42Air  Force,  Statement  of  Budgetary  Activity  (SBA)  Financial  Management  (FM)  Corrective 
Action  Plans  (CAP)  -  Process  Guide  (June  2016). 

43The  Air  Force  defines  self-identified  deficiencies  as  those  identified  during  walk-throughs 
and  FIAR  testing  as  well  as  findings  and  recommendations  from  IPA  audits  and 
examinations  conducted  prior  to  the  fiscal  year  201 5  Budgetary  Schedule  audit. 
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The  Air  Force  did  not  design  comprehensive  policies  and  procedures  for 
how  it  identifies  and  tracks  all  of  its  financial  management-related  findings 
and  recommendations.  While  the  Air  Force  had  developed  a  mechanism 
for  identifying  and  tracking  the  findings  and  recommendations  from  AFAA, 
self-identified  deficiencies,  and  its  fiscal  year  2015  Budgetary  Schedule 
audit,  it  had  not  established  a  similar  process  for  identifying  and  tracking 
most  other  findings  and  recommendations  from  other  audits,  such  as 
those  conducted  by  the  DOD  OIG  and  GAO.  Therefore,  the  Air  Force  did 
not  track  the  complete  universe  of  its  financial  management-related 
findings  and  recommendations  from  all  sources. 

Moreover,  the  Air  Force  had  policies  and  procedures  for  following  up  on 
DOD  OIG  and  GAO  reports,  but  these  policies  and  procedures — which 
are  described  in  Air  Force  Instructions  65-402,  Financial  Management: 
Relations  with  the  Department  of  Defense,  Office  of  the  Assistant 
Inspector  Generals  for  Auditing  and  Analysis  and  Follow  Up  44  and  65- 
401 ,  Financial  Management:  Relations  with  the  Government 
Accountability  Office45 — primarily  discussed  the  audit  report  processes 
and  applicable  roles  and  responsibilities,  but  did  not  assign  the  tracking  of 
the  DOD  OIG  and  GAO  audit  findings  and  recommendations  to  anyone  in 
the  Air  Force.  Instead,  the  Air  Force  relies  on  the  DOD  OIG  to  track  and 
follow  up  on  any  Air  Force-related  DOD  OIG  and  GAO  findings  and 
recommendations.  As  noted  previously,  in  accordance  with  the 
Implementation  Guide  for  OMB  Circular  A-123,  the  Air  Force  is 
responsible  for  tracking  and  addressing  any  recommendations  that  the 
DOD  OIG  or  GAO  made  to  it.  Unless  the  Air  Force  actively  tracks  findings 
and  recommendations  and  reasonably  assures  that  it  has  a  complete 
universe  of  findings  and  recommendations  from  all  audit  sources  and  has 
assigned  responsibility  for  addressing  them,  it  increases  the  risk  that  it 
may  not  adequately  address  and  remediate  all  deficiencies  that  could 
hinder  it  from  becoming  fully  audit  ready. 

Without  specific  procedures  in  place  for  identifying  and  tracking  financial 
management-related  audit  findings  and  recommendations  from  all 
sources,  the  Air  Force  is  at  risk  of  not  addressing  the  complete  universe 
of  its  findings  and  recommendations.  If  the  Air  Force  does  not  identify  and 

44Air  Force,  Financial  Management:  Relations  with  the  Department  of  Defense,  Office  of 
the  Assistant  Inspector  Generals  for  Auditing  and  Analysis  and  Follow  Up,  Air  Force 
Instruction  65-402  (July  19,  1994). 

45Air  Force,  Financial  Management:  Relations  with  the  Government  Accountability  Office 
(GAO),  Air  Force  Instruction  65-401  (Feb.  16,  2016). 
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track  the  complete  universe  of  its  unresolved  deficiencies  related  to 
financial  management,  it  cannot  provide  reasonable  assurance  that  all 
such  deficiencies  will  be  addressed  in  a  timely  manner,  which  can 
ultimately  affect  the  reliability  of  its  financial  information  and  the 
auditability  of  its  financial  statements. 


The  Air  Force  policies  and  procedures  for  prioritizing  its  financial 
management-related  audit  findings  and  recommendations  do  not 
reasonably  assure  that  all  findings  and  recommendations  are 
appropriately  prioritized.  This  is  because  the  CAPs  Process  Guide 
includes  limited  criteria  for  prioritizing  Budgetary  Schedule  audit  findings 
and  self-identified  deficiencies.  The  guidance  also  describes  different 
priority  designations  (Priorities  1 ,  2,  and  3)  for  the  Budgetary  Schedule 
audit  findings  and  recommendations  and  self-identified  financial 
management-related  deficiencies.46  However,  the  guidance  is  silent  on 
other  financial  management-related  deficiencies  from  other  sources,  such 
as  AFAA,  DOD  OIG,  and  GAO.  Additionally,  the  Air  Force  guidance  does 
not  specify  prioritizing  recommendations  based  upon  financial 
management  impact  but  rather  upon  the  source  of  the  finding.  For 
example,  a  self-identified  deficiency  is  assigned  a  Priority  1  if  the  finding 
and  recommendation  align  with  an  Air  Force  team  working  in  specific 
areas.  The  Implementation  Guide  for  OMB  Circular  A-1 23  and  FIAR 
Guidance  state  that  the  extent  to  which  corrective  actions  are  tracked  by 
the  agency  should  be  commensurate  with  the  severity  of  the  deficiency. 
Given  the  significant  number  of  findings  and  recommendations  that  the 
Air  Force  has  received  from  the  various  audit  entities,  it  is  important  for 
the  Air  Force  to  appropriately  prioritize  them  to  help  achieve  audit 
readiness. 

The  Air  Force  has  policies  and  procedures  for  following  up  on  AFAA, 

DOD  OIG,  and  GAO  reports  that  are  set  forth  in  Air  Force  Instructions  65- 
403,  Financial  Management:  Followup  on  Internal  Air  Force  Audit 


46Priorities  are  assigned  to  Budgetary  Schedule  audit  findings  and  recommendations 
based  on  the  following  criteria:  Priority  1  (directly  resulted  in  disclaimer  or  qualified 
opinion);  Priority  2  (indirectly  resulted  in  disclaimer  or  qualified  opinion);  and  Priority  3 
(resulted  in  a  material  weakness  or  lower-level  deficiency).  Priorities  are  assigned  to  self- 
identified  deficiencies  based  on  the  following  criteria:  Priority  1  (deficiency  aligns  with  the 
Air  Force  Tiger  Teams  efforts,  such  as  those  on  journal  vouchers  and  service  providers); 
Priority  2  (process  or  internal  control  gaps);  and  Priority  3  (policy  gap  or  noncompliance). 
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Reports,47  and  Instructions  65-402  and  65-401,  but  these  also  do  not 
describe  prioritization.  Without  sufficiently  detailed  policies  and 
procedures  for  identifying  and  prioritizing  audit  findings,  the  Air  Force  is  at 
increased  risk  of  not  addressing  its  most  critical  financial  management 
weaknesses  and  achieving  audit  readiness. 


The  Air  Force  does  not  have  detailed  policies  and  procedures  for 
developing  CAPs  for  its  self-identified  financial  management-related 
deficiencies  and  financial  management-related  audit  findings  and 
recommendations  issued  by  the  2015  Budgetary  Schedule  audit  IPA, 
AFAA,  the  DOD  OIG,  and  GAO.  The  CAPs  Process  Guide  describes  the 
Air  Force’s  process  for  developing  CAPs  to  remediate  both  self-identified 
deficiencies  and  audit  findings  and  recommendations  issued  during  the 
fiscal  year  2015  Budgetary  Schedule  audit.  The  guidance  describes  at  a 
high  level  the  process  for  developing  CAPs  and  includes  root  causes, 
milestones,  validation,  and  testing,  but  the  guidance  is  not  sufficiently 
detailed  to  include  all  of  the  elements  recommended  by  the 
Implementation  Guide  for  OMB  Circular  A-123.  For  example,  while  there 
are  several  start  and  end  dates  for  interim  milestones  within  the  CAPs 
guidance,  the  guidance  does  not  include  a  provision  for  the  CAPs  to 
include  the  targeted  corrective  action  dates  (the  dates  of  management 
follow-up).  Also,  the  guidance  does  not  discuss  outcome  measures  for 
assessing  the  effectiveness  of  the  corrective  actions.  During  our  audit,  we 
reviewed  a  status  summary  of  the  CAPs  for  the  fiscal  year  2015 
Budgetary  Schedule  financial-related  findings  and  recommendations  and 
found  that  the  CAPs  did  not  include  all  elements  recommended  by  the 
Implementation  Guide  for  OMB  Circular  A-123,  such  as  the  targeted 
corrective  action  dates  (the  dates  of  management  follow-up)  or  outcome 
measures. 

The  Air  Force  also  has  limited  policies  and  procedures  for  following  up  on 
audit  findings  and  recommendations  from  AFAA,  the  DOD  OIG,  and 
GAO,  which  are  described  in  Air  Force  Instructions  65-403,  65-402,  and 
65-401.  However,  these  documents  do  not  provide  detailed  guidance  on 
developing  CAPs.  While  the  Air  Force  has  an  Audit  Recommendation 
Implementation  Tracking  policy  memo  and  attached  Air  Force  Audit 
Implementation  Plan  Guidance  that  pertains  to  AFAA  recommendations, 


47Air  Force,  Financial  Management:  Followup  on  Internal  Air  Force  Audit  Reports,  Air 
Force  Instruction  65-403  (June  2,  1994). 
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Air  Force’s  Process  for 
Monitoring  the  Status  of  CAP 
Implementation  Is  Incomplete 


these  documents  only  describe  the  process  at  a  high  level  and  do  not 
provide  specific  details  as  to  how  CAPs  for  these  audit  findings  and 
recommendations  would  be  developed  and  monitored.48 

Without  complete  and  sufficiently  detailed  policies  and  procedures  for 
designing  CAPs,  the  Air  Force  is  at  increased  risk  of  developing  CAPs 
that  do  not  include  all  elements  necessary  for  ensuring  accountability  and 
for  effectively  monitoring  the  development  and  implementation  of  CAPs. 
Also,  without  CAP  information  on  AFAA,  DOD  OIG,  and  GAO  financial 
management-related  findings  and  recommendations,  it  is  not  clear  how 
Air  Force  management  can  assess  the  progress  being  made  toward 
achieving  audit  readiness. 


The  Air  Force  does  not  have  detailed  policies  and  procedures  for 
monitoring  progress  against  the  CAPs  for  its  financial  management- 
related  audit  findings  and  recommendations.  The  CAPs  Process  Guide 
describes  at  a  high  level  the  Air  Force’s  process  for  monitoring  and 
reporting  on  the  CAPs’  implementation  to  remediate  both  self-identified 
deficiencies  and  audit  findings  and  recommendations  issued  during  the 
fiscal  year  2015  Budgetary  Schedule  audit.  The  guidance  provides  a  brief 
description  of  the  monitoring  to  be  performed  by  the  responsible 
organization,  but  the  guidance  is  not  complete.  For  example,  the 
guidance  describes  that  regular  updates  on  progress  of  the  CAPs  should 
be  provided  to  the  Air  Force  financial  management  CAP  lead  by  the  office 
of  primary  responsibility.49  However,  as  recommended  by  the 
Implementation  Guide  for  OMB  Circular  A-123,  the  guidance  does  not 
discuss  specific  details,  such  as  the  role  of  the  Air  Force’s  Senior 
Assessment  Team  (Air  Force  Financial  Improvement  Executive  Steering 
Committee)  in  resolving  deficiencies,  setting  targeted  corrective  action 
dates,  and  determining  outcome  measures. 

Without  having  complete  policies  and  procedures  to  describe  all  aspects 
of  the  Air  Force’s  CAP  monitoring  process,  the  Air  Force  is  at  increased 
risk  that  CAP  implementation  will  not  be  adequately  monitored;  this  could 
result  in  some  CAPs  not  receiving  adequate  attention  and  therefore  not 


48Department  of  the  Air  Force,  Air  Force  Audit  Recommendation  Implementation  Tracking 
Memorandum  (Nov.  23,  2015). 

49An  Air  Force  CAP  lead  serves  as  the  primary  point  of  contact  for  the  corrective  actions 
assigned  and  provides  status  updates  to  Air  Force  financial  management  leadership. 
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being  implemented  in  a  timely  manner,  which  could  negatively  affect  the 
Air  Force’s  efforts  to  achieve  audit  readiness. 


DOD’s  Process  for 
Monitoring  and 
Reporting  on  Audit 
Remediation  Efforts 
Lacks 

Comprehensive 

Information 


Although  the  DOD  Comptroller’s  office  has  established  several  elements 
of  a  department-wide  audit  readiness  remediation  process,  it  does  not 
have  the  comprehensive  information  on  the  status  of  all  CAPs  throughout 
the  department  needed  to  fully  monitor  and  report  on  the  progress  being 
made  to  resolve  financial  management-related  deficiencies  that  preclude 
DOD  from  being  auditable.  Specifically,  (1)  the  DOD  Comptroller’s  office 
is  not  able  to  fully  assess  the  military  services’  progress  because  it  does 
not  obtain  complete,  detailed  information  on  all  of  their  CAPs  related  to 
critical  capabilities — those  identified  in  the  FIAR  Guidance  as  necessary 
to  achieve  auditability — and  (2)  reports  to  internal  stakeholders  and 
external  stakeholders,  such  as  DOD  OIG,  OMB,  GAO,  and  Congress,  on 
the  status  of  audit  readiness  do  not  provide  comprehensive  information. 
As  a  consequence,  the  DOD  Comptroller’s  office  is  unable  to  provide  and 
prepare  department-wide,  comprehensive  information  on  the  status  of  all 
CAPs  related  to  critical  capabilities  that  are  necessary  to  achieve 
auditability.  Having  comprehensive  DOD-wide  information  on  the  CAPs 
related  to  critical  capabilities  will  take  on  additional  importance  as  DOD 
moves  forward  with  audits  that  have  broader  scopes  beyond  its  budgetary 
statements,  potentially  leading  to  other  findings  being  identified. 


DOD  Does  Not  Obtain 
Detailed  Information  on  All 
CAPs  from  the  Military 
Services  Related  to 
Critical  Capabilities  to 
Fully  Assess  Progress 


The  Implementation  Guide  for  OMB  Circular  A-123  states  that  the  senior 
management  council,  or  similar  forums,  has  ownership  and  accountability 
for  resolving  deficiencies.  Such  forums  should  use  CAPs  as  a  road  map 
for  discussion  as  well  as  in  determining  when  sufficient  action  has  been 
taken  to  declare  that  a  deficiency  has  been  corrected.  The 
Implementation  Guide  for  OMB  Circular  A-1 23  also  recommends  that  a 
senior  assessment  team  communicate  the  status  of  CAPs  developed  for 
material  weaknesses  to  the  senior  management  council  on  a  regular 
basis.  The  senior  management  council  should  be  responsible  for 
determining  if  the  progress  is  sufficient  or  if  additional  action  must  be 
taken  to  expedite  the  remediation  process.  DOD  Comptroller  officials  told 
us  that  the  FIAR  Governance  Board  is  considered  DOD’s  equivalent  of  a 
senior  management  council  as  described  in  the  Implementation  Guide  for 
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OMB  Circular  A-1 23. 50  Further,  the  Implementation  Guide  for  OMB 
Circular  A-1 23  recommends  that  an  agency  establish  a  CAP  framework 
to  facilitate  stakeholder  oversight  and  ensure  accountability  for  results. 

For  example,  the  agency  could  prepare  a  CAP  management  summary 
that  is  made  available  to  external  stakeholders  and  to  the  agency  senior 
management  council. 

In  addition,  the  April  2016  FIAR  Guidance  identifies  the  following  seven 
capabilities  as  being  critical  to  achieving  audit  readiness  and  therefore  the 
highest  priorities  for  corrective  actions:  (1)  produce  a  universe  of 
transactions;  (2)  reconcile  its  Fund  Balance  with  Treasury;  (3)  provide 
supporting  documentation  for  adjustments  to  its  financial  records; 

(4)  validate  the  existence,  completeness,  rights,  and  obligations  of  its 
assets;  (5)  establish  processes  to  manage  and  value  its  assets  correctly; 
(6)  establish  an  auditable  process  for  estimating  and  recording  its 
environmental  and  disposal  liabilities;  and  (7)  implement  critical 
information  technology  controls  for  its  financial  systems. 

DOD  Comptroller  officials  told  us  that  as  part  of  their  process  to  update 
the  FIAR  Guidance,  generally  about  once  a  year,  they  also  consider 
whether  any  additional  critical  capabilities  should  be  identified  in  the 
guidance.  Because  the  critical  capabilities  are  the  DOD  Comptroller’s 
highest  priorities  for  corrective  actions,  it  is  important  that  they  are 
updated  to  reflect  the  audit  findings  that  result  from  DOD’s  audit 
readiness  efforts.  For  example,  one  of  the  seven  critical  capabilities 
currently  addresses  the  need  for  supporting  documentation  for 
adjustments  to  financial  records.  However,  as  stated  previously,  the  IPAs 
for  all  three  military  services  noted  the  lack  of  adequate  supporting 
documentation  for  transactions,  not  just  adjustments,  as  a  reportable 
finding  on  their  Budgetary  Schedule  audits,  which  also  contributed  to 
each  IPA’s  disclaimer  of  opinion.  Appropriate  documentation  for  financial 
transactions  allows  the  military  services  to  support  financial  statement  line 
items  and  allows  auditors  to  test  the  line  items.  Expanding  the  critical 
capabilities  to  reflect  significant  audit  findings  will  increase  the  ability  of 


50 According  to  the  FIAR  Guidance,  the  FIAR  Governance  Board  provides  vision, 
leadership,  oversight,  and  accountability  for  DOD’s  efforts  to  achieve  and  sustain  full 
financial  statement  auditability.  The  board  is  co-chaired  by  the  Comptroller  and  the  DOD 
DCMO.  Its  members  include  the  military  department  DCMOs,  military  department 
assistant  secretaries  for  financial  management  and  comptroller,  DOD  functional 
community  senior  leaders  (e.g.,  the  Assistant  Secretary  -  Logistics  and  Material 
Readiness),  and  the  DOD  OIG  (advisory  member). 
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the  DOD  Comptroller  to  monitor  and  report  on  the  CAPs  most  likely  to 
affect  audit  readiness. 

DOD  has  designed  a  department-wide  process  to  monitor  and  report  on 
the  department’s  audit  readiness  and  remediation  efforts.  According  to 
DOD  Comptroller  officials,  the  department-wide  process  consists  primarily 
of  the  following  procedures:  (1)  obtaining  periodic  updates  on  summary- 
level  interim  milestones  and  percentages  of  completion  for  major 
processes  related  to  critical  capabilities  (but  not  for  specific  CAPs  related 
to  these  critical  capabilities),51  (2)  attending  various  meetings  with  the 
military  services  and  other  defense  organizations  to  discuss  and  obtain 
high-level  updates  on  the  status  of  CAPs  and  other  audit  readiness 
efforts,  (3)  obtaining  and  tracking  the  status  of  all  findings  and 
recommendations  from  service  providers  and  other  defense 
organizations,  and  (4)  reporting  the  status  of  audit  readiness  efforts  to 
Congress  and  other  stakeholders  in  semiannual  FIAR  Plan  Status 
Reports.52 

According  to  DOD  Comptroller  officials,  the  offices  of  the  DCMO  and  the 
DOD  Comptroller  are  the  main  parties  at  the  department  level  that  are 
involved  in  monitoring  financial  management  improvement  and  audit 
readiness  efforts  throughout  DOD.  To  monitor  the  status  of  the  military 
services’  remediation  efforts,  officials  from  both  of  these  offices  attend 
bimonthly  (i.e.,  every  other  month)  FIAR  Governance  Board  meetings  to 
discuss  and  obtain  high-level  updates  on  the  status  of  military  services’ 
CAPs  and  other  audit  readiness  efforts.  In  addition,  DOD  Comptroller 
officials  attend  other,  more  frequent  meetings  (e.g.,  audit  committee)  with 
the  military  services  regarding  their  audit  readiness  efforts.  During  these 
meetings,  DOD  officials  receive  briefing  slides  that  provide  high-level 
summaries  of  the  military  services’  audit  readiness,  including  some 
information  on  the  status  of  the  CAPs  relating  to  the  Budgetary  Schedule 
audits  that  each  service,  using  its  respective  criteria,  has  determined  to 
be  high  priority. 


51  Based  on  DOD’s  spreadsheet  used  to  record  milestone  updates  from  the  military 
services,  one  example  of  a  major  process  related  to  a  critical  capability  is  a  military 
service’s  ability  to  reconcile  the  population  of  transaction  details  to 
feeder/source/originating  systems  for  the  Budgetary  Schedule. 

520ther  defense  organizations  are  a  group  of  50  organizations  and  funds,  other  than  the 
three  military  services  and  service  providers,  that  represent  nearly  20  percent  of  the 
department’s  budgetary  resources.  The  audit  readiness  efforts  of  other  defense 
organizations  and  service  providers  were  not  part  of  the  scope  of  this  audit. 
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DOD  Comptroller  officials  told  us  that  they  compile  some  of  this 
summary-level  information,  such  as  the  percentages  of  completion  for 
critical  capabilities  by  various  DOD  components,  based  on  more  detailed 
information  that  they  receive  from  the  components.  However,  even  this 
more  detailed  information  is  based  on  some  summarization  of  tasks  that 
are  part  of  the  critical  capabilities,  as  well  as  the  percentages  of 
completion  for  these  tasks.  Except  for  certain  findings  and 
recommendations  related  to  DOD-wide  issues,  DOD  Comptroller  officials 
said  that  they  do  not  receive  detailed  information  on  individual  findings, 
recommendations,  and  CAPs  from  the  military  services.53  Although  the 
DOD  Comptroller  developed  a  Notice  of  Findings  and  Recommendations 
Tracking  Tool,  it  is  used  primarily  to  track  the  audit  readiness  findings  and 
recommendations  for  the  other  defense  organizations  and  findings  and 
recommendations  for  the  military  services  that  pertain  to  DOD-wide 
issues  that  require  action  at  the  department  level.  DOD  Comptroller 
officials  said  that  because  of  resource  constraints,  they  do  not  plan  to 
obtain  or  track  the  detailed  status  of  most  of  the  military  services’  findings, 
recommendations,  and  CAPs,  but  instead  will  rely  on  the  information 
provided  for  various  oversight  meetings  to  monitor  the  status  of  audit 
readiness  efforts.  The  officials  also  explained  that  they  have  obtained 
some  detailed  findings  and  recommendations  related  to  DOD-wide  issues 
that  they  are  using  to  help  develop  policies  to  address  these  issues.  As 
new  policies  are  issued,  then  the  military  services  will  likely  need  to 
develop  CAPs  to  implement  the  new  policies. 

As  described  above,  the  DOD  Comptroller  receives  some  details  about 
the  status  of  the  seven  critical  capabilities  at  the  military  services. 
However,  without  obtaining  all  of  the  military  services’  findings, 
recommendations,  and  related  CAPs  with  consistent  data  elements 
pertaining  to  the  seven  critical  capabilities,  the  DOD  Comptroller’s  office 
and  other  DOD  officials  could  be  limited  in  their  ability  to  adequately 
monitor  these  issues.54  Further,  without  detailed,  consistent,  and  timely 


53According  to  DOD  Comptroller  officials,  DOD-wide  issues  are  any  issues  that  could 
affect  more  than  one  component  of  the  department  and  require  DOD  Comptroller 
assistance  in  their  remediation,  such  as  a  department-wide  policy  update  or  issuance. 
Examples  of  DOD-wide  issues  include  accruals  and  intragovernmental  eliminations. 

54 As  noted  previously,  the  six  CAP  elements  recommended  by  the  Implementation  Guide 
for  OMB  Circular  A-1 23  are  as  follows:  a  summary  description  of  the  deficiency,  the  year 
first  identified,  the  targeted  corrective  action  date  (the  date  of  management  follow-up),  the 
agency  official  responsible  for  monitoring  progress,  outcome  measures  for  assessing  the 
effectiveness  of  the  corrective  actions,  and  interim  milestones  for  monitoring  progress  on 
interim  actions. 
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updates  (e.g.,  updates  for  the  bimonthly  FIAR  Governance  Board 
meetings)  from  the  military  services  on  the  status  of  CAPs  related  to  the 
critical  capabilities,  DOD  officials  will  not  have  the  consistent,  readily 
available  information  needed  to  effectively  monitor  and  report  the  status 
of  these  CAPs.  Having  consistent,  readily  available  information  on  these 
types  of  CAPs  will  take  on  additional  importance  as  DOD  moves  forward 
with  more  audits  beyond  its  Budgetary  Schedules,  potentially  leading  to 
more  findings  being  identified. 


Reports  on  Audit 
Readiness  Status  Do  Not 
Provide  Comprehensive 
Information  for 
Stakeholders 


DOD  is  also  responsible  for  reporting  the  status  of  audit  readiness  and 
remediation  efforts  to  its  internal  stakeholders  and  its  external 
stakeholders,  such  as  the  DOD  OIG,  OMB,  GAO,  and  Congress.  For 
example,  the  2010  NDAA  required  that  DOD  provide  recurring, 
semiannual  reports  by  May  15  and  November  15  on  the  status  of  the 
department’s  implementation  of  the  FIAR  Plan  to  congressional  defense 
committees.  Federal  internal  control  standards  also  require  that  an 
entity’s  management  communicate  with  and  obtain  quality  information 
from  external  parties  through  established  reporting  lines.55  In  these 
communications,  management  should  include  information  relating  to  the 
entity’s  activities  that  affect  the  internal  control  system.  DOD’s  FIAR  Plan 
Status  Reports  are  the  department’s  primary  mechanism  for  reporting  the 
status  of  its  audit  readiness,  including  audit  remediation  efforts,  to 
Congress  and  other  external  parties.  The  reports  include  narratives  on 
each  military  service’s  audit  readiness  efforts,  focusing  on  material 
weaknesses  and  the  seven  critical  capabilities  necessary  to  achieve  audit 
readiness,  and  estimated  completion  dates  for  each  of  these  areas.  Over 
the  years,  as  the  military  services  have  set  target  dates  for  asserting  audit 
readiness,  the  target  dates  have  been  delayed,  which  we  have  reported 
increases  the  risk  that  DOD  may  not  complete  its  audit  readiness  efforts 
within  planned  time  frames,  thereby  affecting  DOD’s  ability  to  meet  the 
statutory  requirements.  For  example,  we  recently  reported  that  the 
military  services’  target  dates  for  asserting  audit  readiness  for  real 


55GAO-14-704G. 
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property  were  delayed  by  at  least  2  years.  In  addition,  we  have  reported 
that  the  military  services’  SBR  milestone  dates  had  been  delayed.56 

Further,  although  the  FIAR  Plan  Status  Reports  appropriately  provide 
summary-level  information,  they  do  not  provide  the  detailed  information 
that  might  be  needed  by  some  stakeholders.  For  example,  even  though 
the  reports  contain  summary-level  information  regarding  milestones  for 
the  seven  critical  capabilities,  they  do  not  include  the  detailed  actions  and 
interim  milestones  for  the  CAPs  related  to  critical  capabilities,  which  could 
provide  a  more  complete  picture  of  the  status  of  corrective  actions.  The 
Implementation  Guide  for  OMB  Circular  A-123  recommends  that  such 
detailed  information  about  CAPs  be  provided  to  external  stakeholders 
upon  request.  However,  if  DOD  does  not  routinely  obtain  consistent  and 
detailed  information  from  the  military  services  on  the  status  of  their  CAPs, 
it  cannot  readily  provide  this  type  of  information  to  stakeholders  when 
requested  and  must  instead  rely  on  inefficient  methods,  such  as  data 
calls  to  collect  detailed  information  for  stakeholders.57 

As  part  of  our  past  audits  of  the  consolidated  financial  statements  of  the 
U.S.  government,  we  have  observed  significant  progress  being  made  in 
improving  federal  financial  management  government-wide.  For  example, 
nearly  all  of  the  24  Chief  Financial  Officers  (CFO)  Act  agencies  received 
unmodified  or  “clean”  opinions  on  their  fiscal  year  2015  financial 
statements,  up  from  6  CFO  Act  agencies  that  received  clean  audit 
opinions  in  1996  when  the  CFO  Act  agencies  were  first  required  to 
prepare  audited  financial  statements.  For  example,  the  Department  of 
Homeland  Security  (DHS)  was  able  to  overcome  its  numerous  material 
weaknesses  that  had  prevented  its  financial  statements  from  being 
auditable.  Since  its  creation  in  fiscal  year  2003  when  22  separate 
agencies  were  brought  together  to  form  the  new  department,  DHS  was 
able  to  move  from  receiving  disclaimers  of  opinion  on  its  financial 
statements  to  first  achieving  an  unqualified  or  “clean”  opinion  on  all  of  its 


56See  GAO,  DOD  Financial  Management:  Greater  Visibility  Needed  to  Better  Assess 
Audit  Readiness  for  Property,  Plant,  and  Equipment,  GAO-16-383  (Washington,  D.C.: 
May  26,  2016),  and  DOD  Financial  Management:  Actions  Under  Way  Need  to  Be 
Successfully  Completed  to  Address  Long-standing  Funds  Control  Weaknesses, 
GAO-14-94  (Washington,  D.C.:  Apr.  29,  2014). 

57 A  data  call  is  a  request  by  DOD  for  specific  data  from  the  military  services  and  other 
DOD  components.  Data  calls  are  an  inefficient  and  unreliable  means  for  collecting 
information  from  subordinate  organizations,  as  opposed  to  having  a  process  in  place  for 
routine  reporting  of  information  that  is  needed  on  a  regular  basis. 
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financial  statements  for  fiscal  year  2013,  which  has  continued  through 
fiscal  year  2016.  DHS  policy  on  corrective  action  plans,  issued  in  fiscal 
year  2012,  indicates  that  its  process  included  maintaining  a  department¬ 
wide  accumulation  of  significant  CAPs  from  all  of  its  components;  using 
standard  data  elements;  and  providing  monthly  updates  on  the  status  of 
CAPs  to  the  CFO,  and  updates  on  an  as-needed  basis  to  the  OIG  and  the 
Secretary. 

As  we  have  previously  reported,  many  of  the  planned  audit  readiness 
actions  and  milestones  reported  by  DOD  and  its  components  in  FIAR 

Plan  Status  Reports  have  not  been  realized.58  Given  the  short  amount  of 
time  remaining  before  the  statutory  deadline  of  March  31,  2019,  for 
submitting  to  Congress  the  results  of  an  audit  of  its  fiscal  year  2018 
financial  statements,  having  complete,  reliable,  and  detailed  information 
on  the  department-wide  status  of  CAPs  related  to  critical  capabilities  is 
essential  for  DOD  and  its  stakeholders  so  that  they  can  measure  and 
communicate  DOD’s  progress  in  addressing  the  financial  management 
deficiencies  and  determine  if  additional  actions  are  necessary  to  expedite 
the  remediation  process. 

Conclusions 

DOD  is  moving  forward  with  its  efforts  to  achieve  the  goal  of  being  audit 
ready  by  September  30,  2017,  and  as  part  of  this  effort,  had  the  Army, 
Navy,  and  Air  Force  undergo  their  first  audits  of  their  Schedules  of 
Budgetary  Activity  for  fiscal  year  2015.  The  IPAs  for  all  three  military 
services  issued  disclaimers  of  opinion  on  the  respective  services’  fiscal 
year  2015  Schedules  of  Budgetary  Activity  and  identified  material 
weaknesses  in  internal  control.  In  response,  the  Army,  Navy,  and  Air 

Force  have  all  begun  taking  significant  steps  toward  resolving  their 
material  weaknesses,  such  as  developing  and  implementing  CAPs  to 
address  the  IPAs’  recommendations.  However,  none  of  the  military 
services  have  complete  policies  and  procedures  to  identify  and 
sufficiently  track  all  of  their  financial  management-related  findings  and 
recommendations  reported  by  audits,  and  only  the  Navy  has  drafted 
policies  and  procedures  that  effectively  prioritize,  develop,  and  monitor 
the  status  of  its  CAPs’  implementation.  The  DOD  Comptroller  and  DCMO 
have  also  begun  to  take  a  more  active  role  in  monitoring  the  status  of  the 
military  services’  CAPs  to  ensure  that  adequate  progress  is  being  made. 
However,  DOD’s  process  for  monitoring  and  reporting  on  its  audit 

58GAO-1 6-383  and  GAO-14-94. 
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remediation  efforts  lacks  some  of  the  information  recommended  by  the 
Implementation  Guide  for  OMB  Circular  A-1 23.  Specifically,  DOD  does 
not  obtain  comprehensive  information  from  the  military  services  on  the 
status  of  their  CAPs,  such  as  interim  milestones,  completion  dates,  and 
other  indicators  or  targets  that  facilitate  management’s  ability  to  fully 
determine  how  the  resolution  of  CAPs  is  progressing.  This  type  of 
detailed  information  is  critical  for  DOD  management  and  its  external 
stakeholders  to  evaluate  the  progress  that  DOD  military  services  are 
making  in  correcting  the  deficiencies  that  are  preventing  the  department 
from  obtaining  an  audit  opinion  on  its  financial  statements.  The  lack  of 
comprehensive  information  on  the  status  of  CAPs  increases  DOD’s  risk 
that  it  will  not  be  able  to  fully,  timely,  and  efficiently  correct  its  long¬ 
standing  deficiencies. 


Recommendations  for 
Executive  Action 


To  improve  processes  for  identifying,  tracking,  remediating,  and 
monitoring  financial  management-related  audit  findings  and 
recommendations,  we  are  making  the  following  eight  recommendations. 


Secretary  Of  the  Army  1 .  We  recommend  that  the  Secretary  of  the  Army  direct  the  Internal 

Review  Directorate  under  the  Assistant  Secretary  of  the  Army, 
Financial  Management  and  Comptroller,  to  develop  written  policies 
and  procedures  for  all  financial  management-related  audit  findings 
and  recommendations  under  its  purview  that  include  the  following: 

•  how  the  status  of  the  recommendations  will  be  tracked; 

•  the  process  and  criteria  to  be  followed  for  prioritizing  the  findings 
and  recommendations; 

•  the  process  for  developing  CAPs  to  remediate  the  findings  and 
recommendations,  including  the  detailed  CAP  elements 
recommended  by  the  Implementation  Guide  for  OMB  Circular  A- 
123; and 

•  the  process  for  monitoring  the  status  and  progress  of  the  CAPs, 
including  the  documentation  to  be  maintained  for  monitoring  CAP 
status  and  any  actions  to  be  taken  if  a  lack  of  progress  is  found. 

2.  We  recommend  that  the  Secretary  of  the  Army  direct  the 

Accountability  and  Audit  Readiness  Directorate  under  the  Assistant 
Secretary  of  the  Army,  Financial  Management  and  Comptroller,  to 
enhance  the  directorate’s  policies  and  procedures  for  (1)  tracking  and 
prioritizing  all  financial  management-related  audit  findings  and 
recommendations  under  its  purview  and  (2)  developing  and 
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monitoring  CAPs  for  all  such  recommendations  so  that  they  include 
sufficient  details,  such  as  the  criteria  used  to  prioritize  the  CAPs,  the 
recommended  CAP  elements,  and  the  process  for  monitoring  and 
documenting  the  progress  and  status  of  CAPs. 


Secretary  Of  the  Navy  3.  We  recommend  that  the  Secretary  of  the  Navy,  when  finalizing  the 

Navy’s  policies  and  procedures  for  identifying  and  tracking  its  CAPs  to 
remediate  financial  management-related  audit  findings  and 
recommendations,  enhance  this  guidance  so  it  includes  detailed  steps 
and  specific  procedures  for  confirming  and  validating  the 
completeness  and  accuracy  of  the  status  of  these  audit  findings  and 
recommendations. 


Secretary  Of  the  Air  Force  4.  We  recommend  that  the  Secretary  of  the  Air  Force  design  and 

document  a  comprehensive  process  to  ensure  that  the  complete 
universe  of  all  financial  management-related  findings  and 
recommendations  from  all  audit  sources  is  identified  and  tracked. 

5.  We  recommend  that  the  Secretary  of  the  Air  Force  update  the  Air 
Force’s  written  policies  and  procedures  for  prioritizing  financial 
management-related  audit  findings  and  recommendations  from  all 
audit  sources  and  for  developing  and  monitoring  CAPs  so  that  they 
include  sufficient  details.  These  procedures  should  include  the 
following  details: 

•  The  process  to  be  followed  for  prioritizing  the  financial 
management-related  findings  and  recommendations  from  audit 
sources. 

•  The  guidance  for  developing  CAPs  for  all  financial  management- 
related  audit  findings  and  recommendations  from  all  audit  sources 
to  include  complete  details,  including  the  elements  recommended 
by  the  Implementation  Guide  for  OMB  Circular  A-1 23. 

•  The  process  for  monitoring  the  status  of  the  CAPs  for  all  financial 
management-related  audit  findings  and  recommendations  from  all 
audit  sources,  including  the  documentation  to  support  any 
corrective  actions  taken,  as  recommended  by  the  Implementation 
Guide  for  OMB  Circular  A-1 23. 


Secretary  Of  Defense  6.  To  improve  DOD  management’s  process  for  monitoring  the  military 

services’  audit  remediation  efforts  and  to  provide  timely  and  useful 
information  to  stakeholders  as  needed,  we  recommend  that  the 
Secretary  of  Defense  direct  the  Secretary  of  the  Army,  the  Secretary 
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of  the  Navy,  and  the  Secretary  of  the  Air  Force  to  prepare  and  submit 
to  the  Under  Secretary  of  Defense  (Comptroller),  on  at  least  a 
bimonthly  basis  for  availability  at  the  FIAR  Governance  Board 
meetings,  a  summary  of  key  information  included  in  the  CAPs  that  at 
a  minimum  contains  the  data  elements  recommended  by  the 
Implementation  Guide  for  OMB  Circular  A-123  for  each  CAP  related 
to  critical  capabilities  for  achieving  audit  readiness. 

7.  To  reasonably  assure  that  DOD  management  and  external 

stakeholders  have  a  comprehensive  picture  of  the  status  of  corrective 
actions  needed  for  audit  readiness  throughout  the  department,  we 
recommend  that  the  Secretary  of  Defense  direct  the  Under  Secretary 
of  Defense  (Comptroller)  to  prepare  a  consolidated  CAP  management 
summary  on  a  bimonthly  basis  that  includes  the  data  elements 
referred  to  above  on  the  status  of  all  CAPs  related  to  critical 
capabilities  for  the  military  services  and  for  the  service  providers  and 
other  defense  organizations. 

Under  Secretary  of 
Defense  (Comptroller) 

8.  To  facilitate  the  development  of  a  consolidated  CAP  management 
summary  and  the  ability  to  efficiently  respond  to  stakeholder  requests, 
we  recommend  that  the  Under  Secretary  of  Defense  (Comptroller) 
develop  and  implement  a  centralized  monitoring  and  reporting 
process  that  at  a  minimum  (1)  captures  department-wide  information 
on  the  military  services’  and  other  defense  organizations’  CAPs 
related  to  critical  capabilities,  including  the  standard  data  elements 
recommended  in  the  Implementation  Guide  for  OMB  Circular  A-123, 
and  (2)  maintains  up-to-date  information  on  the  status  of  these  CAPs. 

Agency  Comments 
and  Our  Evaluation 

We  provided  a  draft  of  this  report  to  DOD  and  the  military  services  for 
review  and  comment.  In  their  written  comments,  reprinted  in  appendix  IV, 
the  Army,  Navy,  and  Air  Force  concurred  with  our  respective 
recommendations  to  them,  while  DOD  concurred  with  one 
recommendation  and  partially  concurred  with  two  other  recommendations 
that  we  made  to  it. 

Army 

The  Army  concurred  with  our  recommendation  that  its  Internal  Review 
Directorate  develop  written  policies  and  procedures  for  all  financial 
management-related  audit  findings  and  recommendations  under  its 
purview.  The  Army  stated  that  the  Internal  Review  Directorate  has 
completed  updating  its  policies  and  procedures  to  include  how  the  status 
of  findings  and  recommendations  will  be  tracked  and  prioritized  as  well  as 
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how  CAPs  will  be  developed  and  monitored.  The  Army  also  concurred 
with  our  recommendation  that  its  Accountability  and  Audit  Readiness 
Directorate  enhance  its  policies  and  procedures  for  (1)  tracking  and 
prioritizing  all  financial  management-related  audit  findings  and 
recommendations  under  its  purview  and  (2)  developing  and  monitoring 
CAPs  for  all  such  recommendations  so  that  they  include  sufficient  details, 
such  as  the  criteria  used  to  prioritize  the  CAPs,  the  recommended  CAP 
elements,  and  the  process  for  monitoring  and  documenting  the  progress 
and  status  of  CAPs.  The  Army  stated  that  the  Accountability  and  Audit 
Readiness  Directorate  has  completed  actions  to  enhance  its  current 
standard  operating  procedures  to  include  (1)  updating  its  CAP  database 
and  reporting  tool,  (2)  documenting  its  reporting  procedures,  and 
(3)  updating  its  CAP  template  to  include  additional  elements 
recommended  by  the  Implementation  Guide  for  OMB  Circular  A-1 23.  In 
addition,  the  Army  stated  that  its  policies  and  procedures  include  steps  to 
incorporate  external  financial  management-related  audit  findings 
assigned  to  the  Accountability  and  Audit  Readiness  Directorate  by  the 
Internal  Review  Directorate  and  that  the  existing  process  the  Army  uses 
to  prioritize  findings  and  the  related  CAPs  and  to  monitor  the  progress 
and  status  of  CAPs  has  been  documented. 


Navy  The  Navy  concurred  with  our  recommendation  to  enhance  its  guidance  to 

include  detailed  steps  and  specific  procedures  for  confirming  and 
validating  the  completeness  and  accuracy  of  the  status  of  financial 
management-related  audit  findings  and  recommendations.  The  Navy 
stated  that  it  is  (1)  recording  new  findings  and  recommendations  on  a 
weekly  basis  in  its  deficiency  database,  (2)  reviewing  historical  audits  to 
ensure  that  previous  findings  and  recommendations  are  recorded,  and 
(3)  collaborating  with  audit  agencies  to  establish  a  process  to  reconcile 
the  status  of  recommendations  to  ensure  that  its  deficiency  database 
accurately  reports  open  and  closed  recommendations.  The  Navy  also 
stated  that  these  processes  would  be  documented  and  implemented  by 
January  31,  2017. 


Air  Force  The  Air  Force  concurred  with  our  recommendation  that  the  Air  Force 

design  and  document  a  comprehensive  process  to  ensure  that  the 
complete  universe  of  all  financial  management-related  findings  and 
recommendations  from  all  audit  sources  is  identified  and  tracked.  The  Air 
Force  described  planned  actions  that  it  will  take  to  address  the 
recommendation,  including  revising  the  existing  process  for  identifying 
and  tracking  all  financial  management-related  findings  and 
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recommendations  from  all  audit  sources  and  coordinating  with  all 
stakeholders.  The  Air  Force  plans  to  implement  this  recommendation  by 
January  31,  2018.  The  Air  Force  also  concurred  with  our  recommendation 
to  update  its  written  policies  and  procedures  for  prioritizing  financial 
management-related  audit  findings  and  recommendations  from  all  audit 
sources,  and  for  developing  and  monitoring  CAPs  so  that  they  include 
sufficient  details.  The  Air  Force  stated  that  it  will  revise  its  existing  written 
policies  and  procedures  to  include  (1)  prioritizing  findings  and 
recommendations  and  (2)  providing  guidance  for  developing  detailed  and 
actionable  CAPs  and  for  monitoring  the  status  and  progress  toward 
implementing  and  closing  the  CAPs,  as  recommended  by  the 
Implementation  Guide  for  OMB  Circular  A-1 23.  The  Air  Force  plans  to 
implement  this  recommendation  by  January  31 ,  201 9.  However,  the  Air 
Force’s  planned  implementation  dates  indicate  that  the  changes  to 
policies  and  procedures  will  not  be  in  place  before  fiscal  year  2018,  the 
period  that  the  department-wide  financial  statements  will  be  under  audit. 


DOD  DOD  concurred  with  our  recommendation  that  the  department  direct  the 

military  services  to  prepare  and  submit,  on  at  least  a  bimonthly  basis, 
summaries  of  key  information  included  in  their  CAPs  that  include,  for 
each  CAP  related  to  critical  capabilities,  the  data  elements  recommended 
by  the  Implementation  Guide  for  OMB  Circular  A-1 23.  Specifically,  DOD 
stated  that  it  is  updating  its  template  for  the  military  services  to  use  for 
reporting  this  information  so  that  it  will  include  the  recommended  standard 
data  elements.  In  addition,  it  stated  that  the  FIAR  Guidance  will  be 
updated  to  explicitly  state  that  the  military  services  should  include  these 
data  elements  in  their  CAPs. 

DOD  partially  concurred  with  our  recommendation  that  the  department 
direct  the  DOD  Comptroller  to  prepare  a  bimonthly  consolidated  CAP 
management  summary  that  includes  the  data  elements  outlined  in  the 
Implementation  Guide  for  OMB  Circular  A-1 23  for  all  CAPs  related  to 
critical  capabilities  for  the  military  services  as  well  as  for  the  service 
providers  and  other  defense  organizations.  According  to  DOD,  and  as  we 
stated  in  our  report,  the  military  services  already  provide  summary-level 
updates  on  their  critical  capability  CAPs  at  FIAR  Governance  Board 
meetings.  It  also  stated  that  the  template  that  is  used  to  present  CAPs  to 
the  FIAR  Governance  Board  meetings  at  the  summary  level  has  been 
updated  to  align  CAPs  to  critical  capabilities.  However,  DOD’s  response, 
while  reiterating  what  is  already  being  reported,  does  not  address  how  all 
of  the  data  elements  from  the  Implementation  Guide  for  OMB  Circular  A- 
123  will  be  summarized  or  otherwise  reported  for  all  CAPs  pertaining  to 
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critical  capabilities  across  the  department,  as  we  recommended.  In 
addition,  DOD  stated  that  because  the  DOD  Comptroller  takes 
responsibility  for  maintaining,  monitoring,  and  reporting  on  the  status  of 
CAPs  for  the  service  providers  and  other  defense  organizations  and  of 
DOD-wide  issues,  the  Comptroller  will  also  summarize  this  information. 
However,  it  does  not  provide  any  further  details  about  what  information 
will  be  summarized,  and  as  we  note  in  the  report,  the  Comptroller’s 
tracking  does  not  include  CAPs  for  the  military  services.  Without 
developing  a  consolidated  department-wide  summary  of  CAPs,  DOD  will 
continue  to  lack  a  department-wide  view  of  all  CAPs  pertaining  to  each 
critical  capability.  Therefore,  we  continue  to  believe  that  DOD  needs  to 
take  actions  to  fully  implement  this  recommendation. 

DOD  also  partially  concurred  with  our  recommendation  for  the  DOD 
Comptroller  to  develop  and  implement  a  centralized  monitoring  and 
reporting  process  that  captures  and  maintains  up-to-date  information, 
including  the  standard  data  elements  recommended  in  the 
Implementation  Guide  for  OMB  Circular  A-123,  for  all  CAPs  department¬ 
wide  that  pertain  to  critical  capabilities.  In  its  response,  DOD  said  that  as 
outlined  in  the  military  services’  responses  to  our  recommendations 
directed  to  them,  the  Army,  Navy,  and  Air  Force  have  agreed  to  take  the 
responsibility  for  developing,  maintaining,  and  monitoring  all  CAPs  at  the 
level  recommended  by  the  Implementation  Guide  for  OMB  Circular  A- 
123.  Further,  DOD  stated  that  the  information  reported  at  FIAR 
Governance  Board  meetings,  along  with  the  CAP  information  maintained 
by  the  DOD  Comptroller,  provides  the  department  the  ability  to  efficiently 
respond  to  stakeholder  requests  for  CAPs  related  to  critical  capabilities. 
As  noted  above,  we  acknowledge  the  important  steps  the  military 
services  have  planned  or  taken  to  address  our  recommendations  and 
improve  their  CAP  monitoring  processes.  However,  DOD’s  actions  do  not 
address  our  recommendation  to  develop  a  centralized  reporting  process 
to  capture  department-wide  information  on  the  military  services’  and  other 
defense  organizations’  CAPs  related  to  critical  capabilities. 

As  stated  in  our  report,  DOD  does  not  routinely  obtain  consistent  and 
detailed  information  from  the  military  services  on  the  status  of  their  CAPs, 
and  without  such  it  cannot  readily  provide  this  type  of  information  to 
stakeholders  when  requested  and  must  rely  on  inefficient  methods,  such 
as  data  calls  to  collect  the  detailed  information.  In  addition,  many  of  the 
planned  audit  readiness  actions  and  milestones  reported  by  DOD  and  its 
components  in  the  FIAR  Plan  Status  Reports  have  not  been  realized. 
Given  the  short  amount  of  time  remaining  before  the  statutory  date  of 
March  31 , 2019,  for  submitting  to  Congress  the  results  of  an  audit  of 
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DOD’s  fiscal  year  2018  financial  statements,  having  complete  and 
reliable,  detailed  information  on  the  department-wide  status  of  CAPs 
related  to  critical  capabilities  is  essential  for  DOD  and  its  stakeholders  so 
that  they  can  (1)  measure  and  communicate  DOD’s  progress  in 
addressing  the  financial  management  deficiencies  and  (2)  determine  if 
additional  actions  are  necessary  to  expedite  the  remediation  process. 

This  type  of  detailed  information  is  critical  for  DOD  management  and  its 
external  stakeholders  to  evaluate  the  military  services’  progress  in 
correcting  the  deficiencies  that  are  preventing  the  department  from 
obtaining  an  audit  opinion  on  its  financial  statements.  Moreover,  the  lack 
of  comprehensive  information  on  the  status  of  CAPs  increases  DOD’s  risk 
that  it  will  not  be  able  to  fully,  timely,  and  efficiently  correct  its  long¬ 
standing  deficiencies.  Therefore,  we  continue  to  believe  that  DOD  needs 
to  take  action  to  fully  implement  this  recommendation. 


We  are  sending  copies  of  this  report  to  the  Secretary  of  Defense;  the 
Under  Secretary  of  Defense  (Comptroller)/Chief  Financial  Officer;  the 
Deputy  Chief  Financial  Officer;  the  Director,  Financial  Improvement  and 
Audit  Readiness;  the  Secretary  of  the  Army;  the  Secretary  of  the  Navy; 
the  Secretary  of  the  Air  Force;  the  Director  of  the  Office  of  Management 
and  Budget;  and  appropriate  congressional  committees.  In  addition,  the 
report  will  be  available  at  no  charge  on  GAO’s  website  at 
http://www.gao.gov. 

If  you  or  your  staff  have  any  questions  about  this  report,  please  contact 
me  at  (202)  512-9869  or  khana@gao.gov.  Contact  points  for  our  Offices 
of  Congressional  Relations  and  Public  Affairs  may  be  found  on  the  last 
page  of  this  report.  GAO  staff  who  made  major  contributions  to  this  report 
are  listed  in  appendix  IV. 


Asif  A.  Khan 

Director,  Financial  Management  and  Assurance 
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Our  objectives  were  to  (1 )  report  the  results  of  the  audits  of  the  fiscal  year 
2015  Schedules  of  Budgetary  Activity  (Budgetary  Schedule)  for  the 
military  services,  (2)  determine  the  extent  to  which  each  military  service 
designed  a  process  to  address  identified  financial  management-related 
findings  and  recommendations,  and  (3)  determine  the  extent  to  which  the 
Department  of  Defense  (DOD)  has  designed  a  department-wide  strategy 
to  monitor  and  report  on  audit  readiness  remediation  efforts. 

To  address  our  first  objective,  we  monitored  the  audit  work  of  the  military 
services’  independent  public  accountants  (IPA)  by  attending  status 
meetings,  participating  in  site  visits,  and  coordinating  with  DOD  Office  of 
Inspector  General  (OIG)  officials  to  discuss  the  audits’  progress  and 
challenges  resulting  from  these  first-year  audits.  We  also  reviewed 
documentation  of  the  audit  work  conducted  by  the  IPAs.  We  reviewed 
documentation  related  to  planning,  internal  controls,  testing,  and  reporting 
on  the  audits.  This  included  sampling  plans,  risk  assessments,  test  plans 
and  summaries,  audit  opinions,  and  reports  on  internal  control  and 
compliance  with  laws  and  regulations.  In  addition,  we  reviewed  the  audit 
reports  on  the  Army,  Navy,  and  Air  Force  Budgetary  Schedules  along 
with  other  audit  reports  addressed  to  Army,  Navy,  and  Air  Force 
management  that  detailed  audit  findings  and  recommendations  and  the 
services’  responses  to  these  audit  reports. 

We  reviewed  the  DOD  OIG  audit  contracts  (and  contract  modifications) 
for  the  Army,  Navy,  and  Air  Force  and  the  related  statements  of  work.  We 
also  reviewed  the  management  representation  letters  from  each  military 
service,  which  contained  management’s  assertions  about  the  reliability  of 
its  financial  reporting  in  accordance  with  generally  accepted  accounting 
principles,  as  it  related  to  the  Fiscal  Year  2015  Budgetary  Schedules. 

To  address  our  second  objective,  we  obtained  information  on  the  IPAs’ 
findings  and  recommendations  from  the  Budgetary  Schedule  audits  as 
well  as  other  existing  open  recommendations  or  findings  from  other 
sources  related  to  financial  management  at  the  Army,  Navy,  and  Air 
Force.  We  met  with  applicable  military  service  personnel  to  determine 
what  policies  and  procedures  were  designed  to  (1)  identify  and  track  open 
findings  and  recommendations  from  all  sources;  (2)  prioritize  open 
findings  and  recommendations  by  risk  or  other  factors,  such  as  audit 
impediments  identified  in  the  Financial  Improvement  and  Audit  Readiness 
guidance;  (3)  develop  corrective  action  plans  (CAP)  to  remediate  findings 
and  recommendations;  and  (4)  monitor  the  status  of  the  CAPs’ 
implementation  to  confirm  that  deficiencies  were  remediated.  We 
compared  the  military  services’  policies  and  procedures  with  guidance  for 
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CAPs  in  the  Implementation  Guide  for  OMB  Circular  A-123, 
Management’s  Responsibility  for  Internal  Control,  appendix  A,  “Internal 
Control  over  Financial  Reporting.”  We  also  reviewed  relevant 
documentation  pertaining  to  how  the  military  services  were  carrying  out 
the  aforementioned  procedures. 

For  the  third  objective,  we  held  discussions  with  officials  from  the  office  of 
the  DOD  Deputy  Chief  Management  Officer  (DCMO),  the  military 
services’  respective  DCMOs,  and  officials  from  the  Office  of  the  Under 
Secretary  of  Defense  (Comptroller)  to  determine  what  department-wide 
strategy  has  been  designed  to  monitor  the  military  services’  development 
and  implementation  of  CAPs,  and  what  their  roles  and  responsibilities 
were  with  respect  to  CAP  oversight.  We  also  reviewed  DOD  policies, 
procedures,  and  DOD  management  documentation  to  gain  an 
understanding  of  how  DOD  management  monitors  the  military  services’ 
audit  remediation  activities. 

We  conducted  this  audit  from  March  2015  to  February  2017  in 
accordance  with  generally  accepted  government  auditing  standards. 
Those  standards  require  that  we  plan  and  perform  the  audit  to  obtain 
sufficient,  appropriate  evidence  to  provide  a  reasonable  basis  for  our 
findings  and  conclusions  based  on  our  audit  objectives.  We  believe  that 
the  evidence  obtained  provides  a  reasonable  basis  for  our  findings  and 
conclusions  based  on  our  audit  objectives. 
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The  fiscal  year  2015  Schedule  of  Budgetary  Activity  (Budgetary 
Schedule)  is  an  interim,  military  service-level  special  report  intended  to 
provide  a  building  block  toward  an  audit-ready  Statement  of  Budgetary 
Resources  (SBR)  through  audits  of  consecutive  fiscal  year  schedules  of 
budgetary  activity.  The  Budgetary  Schedule,  like  the  SBR,  is  designed  to 
provide  information  on  budgeted  spending  authority  as  outlined  in  the 
President’s  Budget,  including  budgetary  resources,  availability  of 
budgetary  resources,  and  how  obligated  resources  have  been  used. 
However,  instead  of  covering  the  full  range  of  SBR  activity  on  current  and 
expired  appropriations  that  have  not  been  canceled,  the  first-year 
Budgetary  Schedule  covers  only  activity  for  current  fiscal  year 
appropriations.  Subsequent  fiscal  year  Budgetary  Schedules  would 
include  activity  for  subsequent  years’  appropriations,  building  toward  an 
SBR.  For  example,  in  the  second  year,  the  fiscal  year  2016  Budgetary 
Schedule  would  include  fiscal  year  2016  budgetary  activity  related  to 
fiscal  year  2015  and  2016  appropriations. 

In  making  the  shift  to  focus  on  audit  readiness  for  a  Budgetary  Schedule, 
Department  of  Defense  officials  concluded — based  on  the  difficulties 
encountered  in  obtaining  documentation  for  prior-year  transactions  on  the 
Marine  Corps’  SBR  audit — that  the  most  effective  path  to  an  audit  of  the 
SBR  would  be  to  start  with  reporting  and  auditing  only  current-year 
activity  for  fiscal  year  2015  appropriations  and  to  expand  subsequent 
audits  to  include  current-year  appropriations  and  prior  appropriations 
going  back  to  fiscal  year  2015.  Both  the  SBR  and  the  Budgetary 
Schedule  consist  of  four  separate  but  related  sections  that  provide 
information  about  budgetary  resources,  the  status  of  budgetary 
resources,  changes  in  obligated  balances,  and  outlays  for  major 
budgetary  accounts.1 

•  Budgetary  resources.  This  section  of  a  first-year  Budgetary 
Schedule  shows  total  budgetary  resources  made  available  to  the 
agency  for  obligation  during  the  current  fiscal  year  only.2  It  consists  of 
new  budget  authority,  reimbursements,  and  other  income.  The  first- 
year  Budgetary  Schedule  does  not  include  amounts  from  prior 
periods,  commonly  referred  to  as  beginning  balances.  In  contrast,  the 


Outlays  are  the  issuance  of  checks,  disbursement  of  cash,  or  electronic  transfer  of  funds 
made  to  liquidate  a  federal  obligation. 

2An  obligation  is  a  definite  commitment  that  creates  a  legal  liability  of  the  government  for 
the  payment  of  goods  and  services  ordered  or  received.  Payment  may  be  made 
immediately  or  in  the  future. 
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SBR  includes  amounts  available  from  prior  reporting  periods; 
transfers  available  from  prior-year  balances;  and  adjustments,  such 
as  recoveries  of  prior-year  obligations.  In  addition,  the  SBR  includes 
all  other  information  provided  in  this  section  of  the  Budgetary 
Schedule. 

•  Status  of  budgetary  resources.  This  section  of  the  Budgetary 
Schedule  and  the  SBR  shows  the  status  of  budgetary  resources  at 
the  end  of  the  period  and  consists  of  obligations  incurred  and  the 
unobligated  balances  at  the  end  of  the  period  that  are  available  for 
future  use.  For  the  Budgetary  Schedule  and  the  SBR,  the  total  for  this 
section  must  agree  with  the  total  for  the  budgetary  resources  section, 
as  this  section  describes  the  status  of  total  budgetary  resources.  In 
addition  to  the  current-year  activity,  the  SBR  includes  obligations  that 
are  unavailable  except  to  adjust  or  liquidate  obligations  chargeable  to 
prior  period  appropriations. 

•  Change  in  obligated  balance.  This  section  of  a  first-year  Budgetary 
Schedule  consists  of  obligations  incurred  in  the  current  year,  less 
current-year  outlays.  In  addition  to  current-year  activity,  the  SBR 
would  also  include  unpaid  obligations  brought  forward  from  the  prior 
years  and  recoveries  of  prior-year  unpaid  obligations. 

•  Outlays.  This  section  of  the  Budgetary  Schedule  shows  the 
relationship  between  obligations  and  outlays  (also  referred  to  as 
disbursements  or  expenditures)  and  discloses  payments  made  to 
liquidate  obligations.  Obligations  are  usually  liquidated  by  means  of 
cash  payments  (outlays),  primarily  by  electronic  fund  transfers.  This 
section  reconciles  outlays  with  obligations  incurred  and  the  change  in 
obligated  balances  during  the  year.  The  content  of  this  section  is  the 
same  for  the  SBR  and  the  Budgetary  Schedule. 
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Department  of 
Defense  and  Military 
Service  Financial 
Information  Systems 
Operating 
Environment 


Automated  information  systems  are  essential  for  modern  accounting  and 
recordkeeping.  The  Department  of  Defense  (DOD)  is  developing  its 
Enterprise  Resource  Planning  (ERP)  systems  as  the  backbone  of  its 
financial  management  improvement,  and  they  are  critical  for  transforming 
its  business  operations.1  Implementation  of  ERP  systems  is  critical  to 
ensuring  that  the  department  meets  its  statutory  requirement  to  prepare 
and  submit  audited  department-wide  financial  statements  for  fiscal  year 
2018.  However,  ERP  implementation  has  been  delayed  because  of 
deficiencies  in  functional  capability  and  the  need  for  remedial  corrective 
actions,  which  may  affect  DOD’s  ability  to  achieve  audit  readiness. 
According  to  the  May  2016  Financial  Improvement  and  Audit  Readiness 
(FIAR)  Plan  Status  Report,  while  DOD  continues  to  make  progress  in 
addressing  information  technology  system  audit  readiness  challenges, 
many  of  these  challenges  will  still  exist  for  fiscal  year  2018,  which  is  when 
DOD  is  required  to  undergo  a  financial  statement  audit. 


According  to  DOD  officials,  for  the  ERP  systems  that  will  not  be  fully 
deployed  prior  to  the  financial  statement  audit  readiness  milestone,  the 
DOD  components  will  need  to  identify  effective  work-around  processes  or 
modifications  to  legacy  systems  that  will  enable  audit  readiness.  Without 
fully  deployed  ERPs,  the  department  will  be  challenged  to  produce 
reliable  financial  data  and  auditable  financial  statements  without  resorting 
to  labor-intensive  efforts,  such  as  data  calls  or  manual  work-arounds,  or 
to  provide  reliable  financial  data  on  a  recurring  basis. 


Role  and  Significance 
of  Information 
Systems  in  Effective 
Financial 
Management 


The  department’s  ability  to  improve  its  accounting,  including  accounting 
for  budgetary  information,  has  historically  been  hindered  by  its  reliance  on 
fundamentally  flawed  financial  management  systems  and  processes. 

Effective  information  systems  help  provide  reasonable  assurance  to 
management  and  auditors  that  data  reported  in  the  financial  statements 
are  accurate  and  complete.  When  information  system  controls  are 
effective,  auditors  can  rely  on  these  controls;  when  information  system 
controls  are  not  effective,  auditors  must  perform  substantially  more 
testing.  DOD  has  identified  its  information  system  control  deficiencies  as 
an  impediment  to  its  components  being  able  to  demonstrate  audit 


ERP  system  is  an  automated  system  using  commercial  off-the-shelf  software 
consisting  of  multiple,  integrated  functional  modules  that  perform  a  variety  of  business- 
related  tasks,  such  as  general  ledger  accounting,  payroll,  and  supply  chain  management. 
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readiness  or  successfully  completing  an  audit  because  under  such 
conditions,  neither  management  nor  auditors  can  rely  on  automated 
application  controls  or  system-generated  reports.  In  addition,  without 
adequate  financial  management  processes,  systems,  and  controls,  the 
military  services  are  at  risk  of  having  inaccurate  and  incomplete  data  for 
financial  reporting  and  management  decision  making  and  potentially 
exceeding  authorized  spending  limits.  The  lack  of  effective  internal 
controls  hinders  management’s  ability  to  provide  reasonable  assurance 
that  allocated  resources  are  used  effectively,  properly,  and  in  compliance 
with  budget  and  appropriations  law. 


Reporting  Entity  and 
Service  Provider 
Roles  and 

Responsibilities  in  the 
Audit  Process 


The  complexities  inherent  in  DOD  reporting  entity  and  service  provider 
relationships  and  associated  audit  readiness  interdependencies  make  it 
essential  that  DOD  establish  a  common,  detailed,  written  understanding 
regarding  the  mutual  roles  and  responsibilities  of  the  reporting  entity  and 
the  service  provider.  To  help  ensure  successful  completion  of  audit 
readiness  tasks,  the  reporting  entity  and  service  provider  must  agree  on 
the  roles  and  responsibilities  for  the  authorization,  initiation,  processing, 
recording,  and  reporting  of  transactions;  information  technology  controls 
affected  by  the  service  provider;  or  both.  The  FIAR  Guidance  points  out 
that  a  shared  understanding  and  agreement  between  the  service  provider 
and  the  reporting  entity  on  these  roles  and  responsibilities  must  be 
documented  in  a  service-level  agreement  or  memorandum  of 
understanding.  Details  such  as  the  types  of  supporting  documentation 
that  should  be  retained  for  each  business  process  and  transaction  type, 
which  organization  will  retain  the  specific  documents,  and  the  retention 
period  for  the  documentation  should  be  included  in  the  service-level 
agreement/memorandum  of  understanding.  In  addition,  the  service 
provider  must  provide  a  description  of  the  internal  controls  that  may  affect 
the  reporting  entity’s  financial  reporting  objectives.2 


Areas  in  which  service  providers  play  a  critical  role  on  behalf  of  DOD  that 
continue  to  pose  significant  risks  to  achieving  full  audit  readiness  include 
the  ability  to  support  journal  vouchers  and  the  existence,  completeness, 
and  valuation  of  assets  reported  on  the  Balance  Sheet.  To  facilitate 
progress  in  such  critical  areas,  the  department  has  developed  a  list  of 


internal  control  is  an  integral  component  of  an  organization’s  management  that  provides 
reasonable  assurance  that  the  following  objectives  are  being  met:  effectiveness  and 
efficiency  of  operations,  reliability  of  financial  reporting,  and  compliance  with  applicable 
laws  and  regulations. 
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critical  capabilities  along  with  interim  milestone  dates  by  which  those 
milestones  must  be  completed  and  the  critical  capabilities  must  be 
resolved  department-wide.3  In  addition  to  the  critical  capabilities,  the 
department  identified  DOD-wide  issues,  including  service  provider 
processes  and  systems  that  affect  customer  audit  readiness  and  the 
timing  of  service  provider  audit  readiness  activity. 

As  discussed  in  DOD’s  FIAR  Guidance,  service  providers  working  with 
reporting  entities  are  responsible  for  audit  readiness  efforts  surrounding 
service  provider  systems  and  data,  processes  and  controls,  and 
supporting  documentation  that  have  a  direct  effect  on  reporting  entities’ 
auditability.  The  FIAR  Guidance  requires  the  service  providers  to  have 
their  control  activities  and  supporting  documentation  examined  by  the 
DOD  Office  of  Inspector  General  or  an  independent  auditor  in  accordance 
with  Statement  on  Standards  for  Attestation  Engagements  No.  16  so  that 
components  have  a  basis  for  relying  on  the  service  provider’s  internal 
controls  for  their  financial  statement  audits.  Service  providers  are  subject 
to  separate  examination  engagements  on  the  service  organization’s 
systems  and  the  suitability  of  the  design  and  operating  effectiveness  of 
the  service  organization’s  controls  to  achieve  stated  control  objectives  for 
various  business  processes.  Service  providers  design  processes  and 
related  controls  with  the  assumption  that  complementary  user  entity 
controls  will  be  placed  in  operation  by  user  entities.4  The  application  of 
these  controls  by  user  entities  is  necessary  to  achieve  certain  control 
objectives  within  the  service  organization  reports. 


According  to  the  April  2016  FIAR  Guidance,  these  critical  capabilities  are  related  to 
DOD’s  inability  to  (1)  provide  a  complete  universe  of  transactions  that  is  reconciled  to 
feeder  systems;  (2)  reconcile  Fund  Balance  with  Treasury  (i.e. ,  balance  its  checkbook); 

(3)  provide  supporting  documentation  for  material  adjustments  to  its  financial  records; 

(4)  establish  an  auditable  baseline/process  for  the  existence,  completeness,  and  rights  of 
assets;  (5)  establish  an  auditable  valuation  baseline/process  for  the  valuation  of  assets; 
(6)  establish  an  auditable  process  for  estimating  and  recording  environmental  and 
disposal  liabilities;  and  (7)  implement  critical  information  technology  general  and 
application  controls  for  material,  financially  relevant  systems. 

Complementary  user  entity  controls  are  those  controls  that  management  of  the  service 
provider,  in  designing  the  service(s)  provided,  assumes  are  implemented  by  the 
user/reporting  entity.  The  reporting  entity  must  coordinate  with  the  service  provider  to 
understand  the  service  provider’s  user  control  assumptions  and  test  those  controls  to 
ensure  that  they  are  operating  effectively.  Complementary  user  entity  control 
considerations  should  relate  to  the  control  objectives  specified  in  management’s 
description  of  the  service  provider  system. 
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OFFICE  OF  THE  UNDER  SECRETARY  OF  DEFENSE 
1  1 00  DEFENSE  PENTAGON 
WASHINGTON,  DC  20301-1  10O 

JAN  1  7  2817 

COMPTROLLER 

Mr.  Asif  A.  Khan 

Director,  Financial  Management  and  Assurance 
U.S.  Government  Accountability  Office 
441  G  Street,  NW 
Washington,  DC  20548 

Dear  Mr.  Khan: 

This  is  the  Department  of  Defense  response  to  the  Government  Accountability  Office 
(GAO)  Draft  Report,  GAO-17-85,  “DoD  Financial  Management:  Significant  Efforts  Still 
Needed  for  Remediating  Audit  Readiness  Deficiencies,"  dated  December  6, 201 6  (GAO  Code: 
197144).  For  inclusion  in  your  final  report,  1  am  enclosing  the  Department’s  written  comments 
for  all  eight  recommendations,  including  those  from  the  Military  Departments. 

The  Department  has  worked  extremely  hard  to  develop  the  capability  to  support  an 
annual  financial  audit  regimen  in  most  of  the  Department,  to  include  each  of  our  military 
services.  This  journey  has  and  will  continue  to  provide  significant  value  in  terms  of  better 
visibility  of  our  resources.  Because  earning  positive  audit  opinions  will  likely  require  a  number 
of  years  under  audit,  the  reports’  recommendation  will  be  used  to  enhance  the  current  process 
that  we  use  to  monitor  progress  and  communicate  that  progress  to  interested  stakeholders  in  the 
intervening  period. 

The  Department  appreciates  the  opportunity  to  comment  on  the  draft  report.  Should  you 
need  further  information,  my  point  of  contact  for  this  matter  is  Ms.  Mobola  Kadiri.  Please  reach 
her  at  571-256-2670  or  moboia.a.kadiri.civ@mail.mil. 


Sincerely, 


Deputy  Chief  Financial  Officer 

Enclosures: 

As  stated 

cc: 

Assistant  Secretaries  of  the  Military  Departments  (Financial  Management  and  Comptroller) 
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GAO  DRAFT  REPORT  DATED  DECEMBER  6, 2016 
GAO-17-85  (GAO  CODE  197144) 

“DOD  FINANCIAL  MANAGEMENT:  SIGNIFICANT  EFFORTS  STILL  NEEDED  FOR 
REMEDIATING  AUDIT  READINESS  DEFICIENCIES” 

OFFICE  OF  THE  UNDER  SECRETARY  OF  DEFENSE  (COMPTROLLER) 
COMMENTS  TO  THE  GAO  RECOMMENDATION 

RECOMMENDATION  6:  To  improve  DOD  management’s  process  for  monitoring  the 
military  services’  audit  remediation  efforts  and  to  provide  timely  and  useful  information  to 
stakeholders  asi  needed,  the  GAO  recommend  that  the  Secretary  of  Defense  direct  the  Secretary 
of  the  Army,  the  Secretary  of  the  Navy,  and  the  Secretary  of  the  Air  Force  to  prepar  e  and  submit 
to  the  Under  Secretary  of  Defense  (Comptroller),  on  at  least  a  bi-monthly  basis  for  availability  at 
the  FIAR  Governance  Board  meetings,  a  summary  of  key  information  included  in  the  CAPs  that, 
at  a  minimum,  contains  the  data  elements  recommended  by  the  Implementation  Guide  for  OMB 
Circular  A- 123  for  each  CAP  related  to  critical  capabilities  for  achieving  audit  readiness. 

DoD  RESPONSE:  Concur.  Currently,  DoD  solicits  input  on  a  bi-monthly  basis,  on  critical 
capability  corrective  action  plans  (CAPs)  at  a  summary  level.  This  information  is  provided 
routinely  at  regularly  scheduled  Financial  Improvement  and  Audit  Readiness  (FIAR) 

Governance  Board  meetings.  An  updated  notice  of  findings  and  recommendation  (NFR) 
template  is  being  developed  and  will  be  provided  to  the  Military  Departments.  This  updated  NFR 
template  will  include  the  recommended  standard  data  elements  as  outlined  in  the 
Implementation  Guide,  for  Office  of  Management  and  Budget  (OMB)  Circular  A- 123  to  provide 
greater  transparency  into  the  nature  of  the  remediation  plans.  Finally,  the  FIAR  Guidance  will 
be  updated  to  explicitly  state  that  Military  Services  should  include  the  OMB  recommended 
standard  data  elements  in  their  CAPS. 

RECOMMENDATION  7i  To  reasonably  assure  that  DOD  management  and  external 
stakeholders  have  a  comprehensive  picture  of  the  status  of  corrective  actions  needed  for  audit 
readiness  throughout  the  department,  the  GAO  recommend  that  the  Secretary  of  Defense  direct 
the  Under  Secretary  of  Defense  (Comptroller)  to  prepare  a  consolidated  CAP  management 
summary  on  a  bi-monthly  basis  that  includes  the  data  elements  referred  to  above  on  the  status  of 
all  CAPs  related  to  critical  capabilities  for  the  Military  Services,  as  well  as  for  the  Service 
Providers  and  Other  Defense  Organizations. 

DoD  RESPONSE:  Partially  concur.  Currently,  and  on  a  bi-monthly  basis,  the  Army,  Navy,  and 
Air  Force  provide  an  update  on  their  critical  capabilities  CAPs  at  a  summary  level  at  the  FIAR 
Governance  Board.  The  template  that  is  used  to  present  CAPs  to  the  FIAR  Governance  Board 
meetings  at  the  summary  level  has  been  updated  to  align  NFR  CAPs  to  critical  capabilities. 


For  NFRs  relating  to  the  Service  Providers,  other  enterprise-wide  issues  and  those  specifically 
found- with  Other  Defense  Organizations,  the  OUSD(C)  has  taken  the  responsibility  for 
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maintaining,  monitoring,  and  reporting  on  the  detailed  status  of  CAPs.  The  OUSD(C)  uses  a 
Notice  of  Findings  (NFR)  tracker  to  consolidate  all  Fourth  Estate  CAPs,  and  OUSD(C) 
leadership  uses  the  NFR  tracker  to  monitor  the  Service  Providers  and  Other  Defense 
Organization  CAPs.  This  information  will  be  summarized  by  the  Comptroller. 

RECOMMENDATION  8:  To  facilitate  the  development  of  a  consolidated  CAP  management 
summary  and  the  ability  to  efficiently  respond  to  stakeholder  requests,  the  GAO  recommend  that 
the  Under  Secretary  of  Defense  (Comptroller)  develop  and  implement  a  centralized  monitoring 
and  reporting  process  that,  at  a  minimum,  (1)  captures  department-wide  information  on  the 
military  services’  and  other  defense  organizations’  CAPs  related  to  critical  capabilities,  including 
the  standard  data  elements  recommended  in  the  Implementation  Guide  for  OMB  Circular-  A- 123, 
and  (2)  maintains  up-to-date  information  on  the  status  of  these  CAPs. 

DoD  RESPONSE:  Partially  concur.  As  outlined  in  the  Military  Services  responses,  the  Army, 
Navy,  and  Air  Force  leadership  have  agreed  to  take  the  responsibility  of  developing, 
maintaining,  and  monitoring  all  CAPs  at  the  depth  recommended  by  the  Implementation  Guide 
for  OMB  Circular  A-l  23  (to  include  milestones,  validation  procedures  and  measurable  indicators 
of  progress).  The  Military  Services  are  better  structured  and  aligned  to  track  their  respective 
CAPs  and  an  additional  summary  of  this  information  would  be  redundant.  The  Under  Secretary 
of  Defense  (Comptroller)  (OUSD(C))  leadership  actively  participates  in  monthly  Military 
Service  meetings  with  the  Defense  Chief  Management  Office  to  gain  a  comprehensive 
understanding  of  the  Military  Service  CAPs.  Also,  on  a  bi-monthly  basis,  the  Military  Services 
present  the  status  of  their  critical  capabilities  CAPS  in  the  FIAR  Governance  Board  meetings 
(both  written  and  verbally).  The  level  of  information  presented  aligns  with  the  requirements  of 
the  Implementation  Guide  for  Office  of  Management  and  Budget  (OMB)  Circular  A-123. 

On  a  bi-monthly  basis  at  the  FIAR  Governance  Board  meetings,  the  Army,  Navy,  and  Air  Force 
provides  an  update  on  their  CAPs  related  to  critical  capabilities.  The  template  that  is  currently 
used  to  present  CAPs  has  been  updated  to  prioritize  CAPs  related  to  critical  capabilities. 

Further,  the  OUSD(C)  maintains  up-to-date  information  on  the  status  of  CAPs  related  to  the 
Service  Providers  and  Other  Defense  Organizations.  The  information  presented  during  the  FIAR 
Governance  Board  meeting  along  with  OUSD(C)  maintained  CAP  information  provides  the 
Department  the  ability  to  efficiently  respond  to  stakeholder  requests  for  CAPs  related  to  critical 
capabilities.  Critical  capability  CAP  information  from  the  Military  Services  and  NFR  tracker  is 
summarized  and  reported  on  a  bi-monthly  basis. 
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DEPARTMENT  OF  THE  ARMY 

ASSISTANT  SECRETARY  OF  THE  ARMY 
FINANCIAL  MANAGEMENT  AND  COMPTROLLER 
109  ARMY  PENTAGON 
WASHINGTON  DC  20310-0109 

January  17,  2017 

Mr.  Asif  A.  Khan 

Director,  Financial  Management  and  Assurance 
U  S.  Government  Accountability  Office 
441  G  Street,  NW 
Washington,  D.C.  20548 

Dear  Mr.  Khan, 

In  response  to  the  GAO  Draft  Report  GA0-17-85,  “DOD  FINANCIAL 
MANAGEMENT:  Significant  Efforts  Still  Needed  for  Remediating  Audit  Readiness 
Deficiencies,”  dated  December  6,  2016  (GAO  Code  197144),  the  Assistant  Secretary  of 
the  Army  Financial  Management  and  Comptroller  (ASA  FM&C)  concurs  with  the  two 
recommendations  of  the  GAO  report.  Please  refer  to  the  enclosed  for  specifics  on  the 
ASA  (FM&C)  comments  to  Recommendations  1  and  2.  We  appreciate  this  opportunity 
to  address  the  GAO  recommendations  for  improving  audit  readiness. 
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GAO  DRAFT  REPORT  DATED  DECEMBER  6, 2016 
GAO-17-85  (GAO  CODE  197144) 

“DOD  FINANCIAL  MANAGEMENT:  SIGNIFICANT  EFFORTS  STILL  NEEDED  FOR 
REMEDIATING  AUDIT  READINESS  DEFICIENCIES” 

DEPARTMENT  OF  DEFENSE  COMMENTS 
TO  THE  GAO  RECOMMENDATION 


RECOMMENDATION  1 :  The  GAO  recommends  that  the  Secretary  of  the  Army  direct  the 
Internal  Review  Directorate  under  the  Assistant  Secretary  of  the  Army,  Financial  Management 
and  Comptroller,  to  develop  written  policies  and  procedures  for  all  financial  management-related 
audit  findings  and  recommendations  under  its  purview  that  include  the  following: 

(1)  How  the  status  of  the  recommendations  will  be  tracked; 

(2)  The  process  and  criteria  to  be  followed  for  prioritizing  the  findings  and 
recommendations; 

(3)  The  process  for  developing  CAPs  to  remediate  the  findings  and  recommendations, 
including  the  detailed  CAP  elements  recommended  by  the  Implementation  Guide  for 
OMB  Circular  A-123;  and 

(4)  The  process  for  monitoring  the  status  and  progress  of  the  CAPs,  including  the 
documentation  to  be  maintained  for  mouitoring  CAP  status  and  any  actions  to  be  taken  if 
a  lack  of  progress  is  found. 

ASA  (FM&C)  RESPONSE;  Concur  with  comments.  The  Internal  Review  Directorate,  ASA 
(FM&C)  already  updated  its  written  standard  operating  procedures  identifying  procedures  for 
monitoring  financial  management-related  external  audit  findings  and  recommendations.  This 
new  guidance  includes  an  explanation  of  how  recommendations  will  be  tracked;  how  findings  & 
recommendations  will  be  prioritized,  as  necessary,  how  corrective  action  plans  will  be 
developed;  and  how  the  status  and  progress  of  corrective  action  plans  will  be  monitored.  That 
said,  the  Internal  Review  Directorate  will  primarily  track  and  monitor  corrective  action  plans 
(CAPs)  for  external  audit  recommendations;  however,  development  of  CAPs  will  be  performed 
by  the  functional  staff,  i.e.,  process  owner,  responsible  for  overall  implementation  of  the  audit 
recommendations.  ASA  (FM&C)  will  provide  these  functional  staff  with  advisory  support  as 
they  carry  out  their  responsibilities.  Regarding  prioritization,  the  Internal  Review  Directorate, 
ASA  (FM&C)  will  provide  external  audit  updates  to  Senior  Leaders  during  weekly  ASA 
(FM&C)  meetings.  As  necessary,  the  Army  will  recommend  to  process  owners  the  prioritization 
of  external  findings  and  recommendations  as  we  monitor  CAP  development  status.  Finally,  the 
Managers’  Internal  Control  Program  (MICP)  Senior  Leader  Steering  Group  (SLSG)  will  be 
leveraged  as  a  venue  to  monitor  high  priority  external  audit  recommendations. 

RECOMMENDATION  2:  The  GAO  recommends  that  the  Secretary  of  She  Army  direct  the 
Accountability  and  Audit  Readiness  Directorate  under  the  Assistant  Secretary  of  the  Army, 
Financial  Management  and  Comptroller,  to  enhance  the  Directorate’s  policies  and  procedures  for 
(1)  tracking  and  prioritizing  all  financial  management-related  audit  findings  and 
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recommendations  under  its  purview  and  (2)  developing  and  monitoring  CAPs  for  all  such 
recommendations  so  that  they  include  sufficient  details  such  as  the  criteria  used  to  prioritize  the 
CAPs,  the  recommended  CAP  elements,  and  the  process  for  monitoring  and  documenting  the 
progress  and  status  of  CAPs. 

ASA  (FM&C)  RESPONSE;  Concur  with  comments.  As  described  by  the  report,  the 
Accountability  and  Audit  Readiness  Directorate  has  an  ongoing  robust  program  and  standard 
operating  procedures  for  development,  oversight,  and  monitoring  of  CAPs  and  the  Army 
continues  to  enhance  their  programs,  policies,  and  procedures  to  improve  the  response  to  the 
Independent  Public  Accountant  (IP A)  findings.  The  Army  assigned  Senior  Responsible 
Officials  at  Commands,  HQDA,  Program  Offices,  Program  Executive  Offices,  and  Defense 
Finance  and  Accounting  Service  to  develop  corrective  actions  to  respond  to  the  IPA  findings. 
These  officials  use  scorecards  to  report  out  on  the  status  of  CAP  implementation  during  bi¬ 
monthly  synch  calls.  The  Army  has  also  enhanced  our  governance  process  by  aligning  findings 
and  corrective  actions  to  the  respective  Army  Business  Mission  Area  Champions  to  help  drive 
accountability  and  improvements  needed  in  the  respective  business  areas.  The  Accountability 
and  Audit  Readiness  Directorate's  CAP  database  and  reporting  tool  has  been  updated,  procedures 
for  reporting  have  been  documented,  and  the  Army  has  updated  our  CAP  template  to  include 
additional  elements  recommended  by  OMB  Circulate  A-123.  In  addition,  policies  and 
procedures  include  steps  to  incorporate  external  financial  management  related  audit  findings 
assigned  to  the  Accountability  and  Audit  Readiness  Directorate  by  the  Internal  Review 
Directorate  and  the  existing  process  the  Army  uses  to  prioritize  findings  and  the  related  CAPs 
and  to  monitor  the  progress  and  status  of  the  CAPs  has  been  documented. 

**  Redacted  remaining  recommendations  as  they  were  not  Army  specific. 
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THE  ASSISTANT  SECRETARY  OF  THE  NAVY 
(FINANCIAL  MANAGEMENT  AND  COMPTROLLER) 
1000  NAVY  PENTAGON 
WASHINGTON,  DC  20350-1000 


DEC  2  2  2016 


MEMORANDUM  FOR  UNITED  STATES  GOVERNMENT  ACCOUNTABILITY 
OFFICE 


SUBJECG:  Response  to  the  GAO  Draft  Report  GAO- 1 7-85,  ”DOD  FINANCIAL 

MANAGEMENT:  Significant  Efforts  Still  Needed  for  Remediating  Audit 
Readiness  Deficiencies,”  dated  Decembers  (GAOCodc  107144) 

In  response  to  subject  report  the  Department  o  f  the  Navy  provides  the  attached 
status  on  Recommendation  3. 

My  point  of  contact  for  tiiis  matter  is  Mr.  Joshua  Coover.  who  may  be  contacted  at 
(202)  433-9277  or  by  email  at  joshua.coover@navy.mil. 


//Joseph  B.  Marshall.  Jr.  j/ 


Attachment: 
As  slated 
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GAO  DRAFT  REPORT  DATED  DECEMBER  6, 2016 
GAO-17-85  (GAO  CODE  197144) 

“DOD  FINANCIAL  MANAGEMENT:  SIGNIFICANT  EFFORTS  STILL  NEEDED  FOR 
REMEDIATING  AUDIT  READINESS  DEFICIENCIES” 


RECOMMENDATION  3:  The  GAO  recommends  that  the  Secretary  of  the  Navy,  when  finalizing  the  Navy's 
policies  and  procedures  for  identifying  and  tracking  its  CAPs  to  remediate  financial  management-related 
audit  findings  and  recommendations,  enhance  this  guidance  so  it  includes  detailed  steps  and  specific 
procedures  for  confirming  and  validating  the  completeness  and  accuracy  of  the  status  of  these  audit 
findings  and  recommendations. 

DoN  RESPONSE:  Concur.  The  Navy  has  already  established  a  process  to  review  new  audits  that  are 
released  by  the  GAO,  DoD  IG/and  NAVAUDSVC.  New  findings  and  recommendations  are  recorded  on  a 
weekly  basis  in  the  Navy’s  deficiency  database,  in  addition,  the  Navy  is  reviewing  historical  audits  to 
ensure  that  previous  findings  and  recommendations  are  also  recorded.  In  collaboration  with  the  audit 
agencies,  the  Navy  Will  establish  a  process  to  reconcile  the  status  of  recommendations  to  ensure  the 
deficiency  database  accurately  reports  open  and  closed  recommendations.  These  processes  Will  be 
documented  in  a  standard  operating  procedure  and  the  corresponding  steps  will  be  implemented  by  31 
January  2017. 
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DEPARTMENT  OF  THE  AIR  FORCE 

WASHINGTON  DC 


OFFICE  OF  THE  ASSISTANT  SECRETARY 


20  December  2016 


SAF/FMF 

1130  Air  Force  Pentagon  (Room  5D739) 

Washington  DC  20330-1130 

Mr.  Asif  A.  Khan 

Director,  Financial  Management  and  Assurance 
U.S.  Government  Accountability  Office 
441  G  Street,  NW 
Washington  DC  20548 

Dear  Mr.  Khan, 

This  is  the  Air  Force  (AF)  response  to  the  GAO  Draft  Report  GAO- 1 7-85,  “DOD 
FINANCIAL  MANAGEMENT:  Significant  Efforts  Still  Needed  for  Remediating  Audit 
Readiness  Deficiencies,”  dated  Decembers,  2016  (GAO  Code  197144). 

The  Department  is  providing  official  written  comments  for  inclusion  in  the  report. 

Sincerely, 


FREDRICK  E.  CARR 

Associate  Deputy  Assistant  Secretary 

(Financial  Operations) 
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GAO  DRAFT  REPORT  DATED  DECEMBER  6, 2016 
GAO-17-85  (GAO  CODE  197144) 

“DOD  FINANCIAL  MANAGEMENT:  SIGNIFICANT  EFFORTS  STILL  NEEDED  FOR 
REMEDIATING  AUDIT  READINESS  DEFICIENCIES” 

DEPARTMENT  OF  THE  AIR  FORCE  COMMENTS 
TO  THE  GAO  RECOMMENDATION 


RECOMMENDATION  4:  The  GAO  recommends  that  the  Secretary  of  the  Air  Force  design 
and  document  a  comprehensive  process  to  ensure  that  the  complete  universe  of  all  financial 
management-related  findings  and  recommendations  from  all  audit  sources  are  identified  and 
tracked. 

DoD  RESPONSE:  Concur.  The  Air  Force  will  revise  the  existing  process  for  identifying  and 
tracking  all  financial  management/financial  statement-related  findings  and  recommendations 
from  all  audit  sources.  As  a  part  of  revising  this  process,  the  Air  Force  will  coordinate  with  all 
stakeholders  in  an  effort  to  obtain  agreement  for  providing  SAF/FMF  all  necessary  and  required 
information  on  a  consistent  and  recurring  basis,  supporting  the  Air  Force’s  ability  to  properly 
track  the  findings  and  recommendations.  The  processes  will  include  the  procedures  for 
summarizing  the  status  of  findings  on  a  bimonthly  basis  and  providing  this  summary  to 
OL'SD(C)  in  preparation  for  the  FIAR  Governance  Board  meetings.  This  recommendation  will 
be  implemented  by  31  January  2018. 

RECOMMENDATION  5:  The  GAO  recommends  that  the  Secretary  of  the  Air  Force  update 
the  Air  Force’s  written  policies  and  procedures  for  prioritizing  financial  management-related 
audit  findings  and  recommendations  from  all  audit  sources,  and  for  developing  and  monitoring 
CAPs  so  that  they  include  sufficient  details.  These  procedures  should  include  the  following 
details: 

(1)  The  process  to  be  followed  for  prioritizing  the  financial  management-related  findings  and 
recommendations  from  audit  sources; 

(2)  The  guidance  for  developing  CAPs  for  all  financial  management-related  audit  findings 
and  recommendations  from  all  audit  sources  to  include  complete  details  including  the 
elements  recommended  by  the  Implementation  Guide  for  OMB  Circular  A-123;  and 

(3)  The  process  for  monitoring  the  status  of  the  CAPs  for  all  financial  management-related 
audit  findings  and  recommendations  from  all  audit  sources,  including  the  documentation 
to  support  any  corrective  actions  taken,  as  recommended  by  the  Implementation  Guide 
for  OMB  Circular  A-123. 

DoD  RESPONSE:  Concur.  The  Air  Force  will  revise  the  existing  written  policies  and 
procedures  for  tracking  and  monitoring  ail  financial  management/fmancial  reporting-related 
audit  findings  and  recommendations  from  all  audit  sources.  These  revised  policies  and 
procedures  will  articulate  prioritizing  findings  and  recommendations;  provide  clear  guidance  for 
developing  detailed  and  actionable  CAPs  which  address  the  condition  and  root  cause  of  the 
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findings,  to  include  elements  recommended  by  the  Implementation  Guide  for  OMB  Circular  A- 
123;  and  provide  clear  guidance  for  monitoring  the  status  and  progress  towards  implementing 
and  closing  the  CAPs,  to  include  elements  recommended  by  the  Implementation  Guide  for  OMB 
Circular  A-123.  The  processes  will  include  the  procedures  for  summarizing  the  status  of 
findings  on  a  bimonthly  basis  and  providing  this  summary  to  OUSD(C)  in  preparation  for  the 
FIAR  Governance  Board  meetings.  This  recommendation  will  be  implemented  by  31  January 
2019. 
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GAO’s  Mission 

The  Government  Accountability  Office,  the  audit,  evaluation,  and  investigative 
arm  of  Congress,  exists  to  support  Congress  in  meeting  its  constitutional 
responsibilities  and  to  help  improve  the  performance  and  accountability  of  the 
federal  government  for  the  American  people.  GAO  examines  the  use  of  public 
funds;  evaluates  federal  programs  and  policies;  and  provides  analyses, 
recommendations,  and  other  assistance  to  help  Congress  make  informed 
oversight,  policy,  and  funding  decisions.  GAO’s  commitment  to  good  government 
is  reflected  in  its  core  values  of  accountability,  integrity,  and  reliability. 

Obtaining  Copies  of 
GAO  Reports  and 
Testimony 

The  fastest  and  easiest  way  to  obtain  copies  of  GAO  documents  at  no  cost  is 
through  GAO’s  website  (http://www.gao.gov).  Each  weekday  afternoon,  GAO 
posts  on  its  website  newly  released  reports,  testimony,  and  correspondence.  To 
have  GAO  e-mail  you  a  list  of  newly  posted  products,  go  to  http://www.gao.gov 
and  select  “E-mail  Updates.” 

Order  by  Phone 

The  price  of  each  GAO  publication  reflects  GAO’s  actual  cost  of  production  and 
distribution  and  depends  on  the  number  of  pages  in  the  publication  and  whether 
the  publication  is  printed  in  color  or  black  and  white.  Pricing  and  ordering 
information  is  posted  on  GAO’s  website,  http://www.gao.gov/ordering.htm. 

Place  orders  by  calling  (202)  512-6000,  toll  free  (866)  801-7077,  or 

TDD  (202)512-2537. 

Orders  may  be  paid  for  using  American  Express,  Discover  Card,  MasterCard, 

Visa,  check,  or  money  order.  Call  for  additional  information. 

Connect  with  GAO 

Connect  with  GAO  on  Facebook,  Flickr,  Linkedln,  Twitter,  and  YouTube. 

Subscribe  to  our  RSS  Feeds  or  E-mail  Updates.  Listen  to  our  Podcasts. 

Visit  GAO  on  the  web  at  www.gao.gov  and  read  The  Watchblog. 

To  Report  Fraud, 

Waste,  and  Abuse  in 
Federal  Programs 

Contact: 

Website:  http://www.gao.gov/fraudnet/fraudnet.htm 

E-mail:  fraudnet@gao.gov 

Automated  answering  system:  (800)  424-5454  or  (202)  512-7470 

Congressional 

Relations 

Katherine  Siggerud,  Managing  Director,  siggerudk@gao.gov,  (202)  512-4400, 

U.S.  Government  Accountability  Office,  441  G  Street  NW,  Room  7125, 
Washington,  DC  20548 

Public  Affairs 

Chuck  Young,  Managing  Director,  youngd@gao.gov,  (202)  512-4800 

U.S.  Government  Accountability  Office,  441  G  Street  NW,  Room  7149 

Washington,  DC  20548 

Strategic  Planning  and 
External  Liaison 

James-Christian  Blockwood,  Managing  Director,  spel@gao.gov,  (202)  512-4707 
U.S.  Government  Accountability  Office,  441  G  Street  NW,  Room  7814, 
Washington,  DC  20548 
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Please  Print  on  Recycled  Paper. 

